What is the CVSS score of CVE-2026-13915?

CVE-2026-13915 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Chrome for iOS are affected by CVE-2026-13915?

Google Chrome for iOS contains a critical code execution vulnerability that allows attackers to compromise iOS devices through crafted webpages, potentially enabling data theft and unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-13915?

Within 24 hours: Identify all organizational iOS users with Chrome deployment and assess exposure scope. Within 7 days: Deploy Chrome for iOS version 150.0.7871.47 or later via mobile device management or app store update notifications. Within 30 days: Verify 100% update compliance across all affected devices and monitor security channels for any exploitation indicators.

Chrome for iOS CVE-2026-13915

EUVD-2026-40601 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-8588-2h56-wx82

Denial Of Service Google Use After Free Memory Corruption Apple Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted-page delivery (AV:N/AC:L, PR:N) but mandatory specific user gestures set UI:R; a renderer memory-corruption compromise yields full C:H/I:H/A:H within an unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:30 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.

Technical ContextAI

The flaw is a use-after-free (CWE-416), a memory-safety defect where a pointer to freed heap memory is dereferenced or reused, enabling heap corruption that can be shaped into type confusion and, ultimately, controlled memory writes. It affects Chrome on Apple's iOS platform (cpe target: Google Chrome / iOS, per EUVD 'Chrome 150.0.7871.47'). Note an important platform nuance: Apple mandates that all iOS browsers render via the system WebKit engine, so this Chrome-for-iOS-specific issue most plausibly lives in Chrome's own iOS-specific browser/UI or bridging code rather than the Blink renderer used on desktop; the 'Apple' tag and iOS-only scope reinforce that this is distinct from the corresponding desktop advisory. The lifecycle is triggered by 'specific UI gestures,' implying a state-management/object-lifetime bug reachable through user-driven interaction with attacker content.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome for iOS to 150.0.7871.47 or later via the Apple App Store, which is the definitive fix; enable automatic app updates to ensure coverage across managed fleets. Refer to the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and the Chromium tracker (https://issues.chromium.org/issues/508275293). Until the update is applied, reduce exposure by instructing users not to interact with UI prompts or gestures on untrusted web pages and by steering them to a patched or alternative browser; because exploitation requires visiting attacker-controlled HTML and performing specific gestures, web/content filtering or restricting browsing to trusted sites is a practical compensating control, with the trade-off of reduced browsing flexibility. No app-level configuration flag disables the vulnerable code path, so upgrading is the only complete remediation.