What is the CVSS score of CVE-2026-13910?

CVE-2026-13910 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13910?

Yes, a patch is available for CVE-2026-13910. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13910

EUVD-2026-40596 MEDIUM

Protection Mechanism Failure (CWE-693)

2026-06-30 chrome-cve-admin@google.com

GHSA-9r7r-6r2r-9fmj

Information Disclosure Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Remote delivery via crafted page (AV:N/AC:L), no attacker privileges needed (PR:N), victim page-visit required (UI:R), confidentiality-only leakage with no integrity or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:42 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in the WebXR implementation of Google Chrome on Android (versions prior to 150.0.7871.47) allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by enticing a victim to visit a crafted HTML page. The flaw is rooted in CWE-693 (Protection Mechanism Failure), where WebXR fails to enforce cross-origin isolation policies on Android specifically. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

WebXR is a browser API exposing augmented and virtual reality capabilities to web content. On Android, Chrome's WebXR subsystem failed to correctly enforce the same-origin policy or related cross-origin resource isolation mechanisms (CWE-693: Protection Mechanism Failure), allowing WebXR-context JavaScript to read or infer data from cross-origin resources. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U reflects a purely remotely exploitable, low-complexity flaw gated only on a victim page visit. Per EUVD affected-version data, the vulnerable range is Chrome for Android < 150.0.7871.47. The flaw is platform-scoped to Android; desktop Chrome is not indicated as affected by this CVE. Chromium issue tracker context is available at https://issues.chromium.org/issues/507231605.

RemediationAI

Vendor-released patch: Chrome for Android 150.0.7871.47. Users should update Chrome on Android via the Google Play Store immediately; enabling automatic app updates ensures future patches are applied promptly. The advisory is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control before patching, enterprise administrators can disable or restrict WebXR API access via Chrome enterprise policy (for example, using the WebXR feature flag or content settings policies) - note this will break legitimate WebXR/AR/VR web applications used by employees. Restricting navigation to untrusted or unsolicited external URLs through mobile threat defense or enterprise browser policies reduces delivery surface, but is not a reliable standalone control. No other platform-specific workarounds are confirmed by vendor data.