What is the CVSS score of CVE-2026-13909?

CVE-2026-13909 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13909?

A critical sandbox escape in Google Chrome (before v150.0.7871.47) could allow attackers who have already compromised the renderer process to break out of the browser's security boundary and escalate…. A patch is available.

How to fix or mitigate CVE-2026-13909?

Within 24 hours: Identify all Chrome deployments and enumerate systems running versions before 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later to all critical and user-facing systems. Within 30 days: Complete organizational deployment and validate via inventory audit.

Google Chrome CVE-2026-13909

EUVD-2026-40595 CRITICAL

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-mr9p-7cc9-fh7r

Information Disclosure Google Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a pre-compromised renderer (PR:H) and a chained multi-condition path (AC:H); sandbox escape crosses a trust boundary (S:C) enabling high C/I/A impact, with UI:R for the crafted page.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:29 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome DevTools before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, stemming from insufficient policy enforcement (CWE-693). NVD scores this 9.6 with a scope-change vector, though Google rates the Chromium severity only Medium and it is a second-stage bug requiring prior renderer compromise. No public exploit has been identified at time of analysis and EPSS is low (0.21%), consistent with a chained rather than standalone threat.

Technical ContextAI

The flaw lives in Chrome's DevTools, the built-in debugging/inspection subsystem that communicates with the renderer over the Chrome DevTools Protocol and is granted elevated capabilities relative to ordinary web content. CWE-693 (Protection Mechanism Failure / insufficient policy enforcement) indicates that a security policy meant to constrain what the renderer can request or influence through DevTools was not fully enforced, allowing renderer-controlled input to reach privileged functionality. Because Chrome's multi-process model relies on the renderer being confined by the sandbox, any DevTools path that lets renderer-supplied data escape that boundary undermines the primary isolation guarantee. The affected component is the Chrome desktop browser (per EUVD, cpe scope is Chrome builds prior to 150.0.7871.47 across desktop platforms).

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later via the Stable channel, per Google's advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; confirm the update by restarting the browser so the new build is applied. In managed fleets, push the update through your enterprise update policy rather than relying on user-initiated restarts. Because exploitation requires a compromised renderer, defense-in-depth against the first stage helps: keep site isolation enabled (default) and avoid disabling the sandbox. As a targeted hardening measure, deploy the DeveloperToolsAvailability enterprise policy to disable or restrict DevTools where end users do not need it, which reduces exposure of the vulnerable component at the cost of blocking legitimate in-browser debugging for developers.