What is the CVSS score of CVE-2026-13918?

CVE-2026-13918 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Chrome for iOS are affected by CVE-2026-13918?

Google Chrome for iOS users running versions before 150.0.7871.47 face a memory corruption vulnerability that could allow attackers to inject malicious code through crafted websites, potentially…. A patch is available.

How to fix or mitigate CVE-2026-13918?

Within 24 hours, verify whether iOS-using employees have Chrome installed and assess current version distributions through your mobile device management system. Within 7 days, communicate the availability of Chrome for iOS version 150.0.7871.47 or later to all iOS users and enforce deployment through automatic app store updates or mobile security policy. Within 30 days, confirm that 95% or greater of managed iOS devices running Chrome have been updated to version 150.0.7871.47 or later.

Chrome for iOS CVE-2026-13918

EUVD-2026-40604 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-2h7m-jh29-4fmg

Denial Of Service Google Use After Free Memory Corruption Apple Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs only user interaction (UI:R), no auth (PR:N); UAF can yield full memory compromise, so C/I/A:H, though impact is 'potential' given iOS sandbox.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:51 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.

Technical ContextAI

The vulnerability is a CWE-416 Use-After-Free in the Chrome browser engine, where an object is freed while a dangling pointer to it remains reachable; subsequent access to that pointer reads or writes freed heap memory, enabling heap corruption. Rendering attacker-controlled HTML/DOM structures is the trigger, a classic pattern for browser UAF bugs in DOM, layout, or JavaScript-bindings code. The CPE (cpe:2.3:a:google:chrome:*) is generic and does not scope to the iOS build, but the description and EUVD both specify the Chrome for iOS distribution channel. Note that on iOS all browsers, including Chrome, are required by Apple policy to use the system WebKit engine (WKWebView) rather than Chrome's own Blink/V8, so the practical exploitation surface may differ from desktop Chromium builds - this warrants vendor confirmation.

RemediationAI

Vendor-released patch: 150.0.7871.47 - upgrade Google Chrome for iOS to 150.0.7871.47 or later via the Apple App Store (enable automatic app updates to ensure timely rollout across managed devices). Verify the installed version in Chrome under Settings, About Chrome. Consult the Chrome Releases advisory (http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-13918) for release details. There is no browser-specific configuration workaround for a memory-corruption bug in the rendering path; as interim compensating controls until devices update, restrict browsing to trusted sites, deploy network-level malicious-URL/web filtering to reduce the chance of loading a crafted page, and on managed fleets use MDM to enforce the minimum Chrome version (trade-off: strict version enforcement can block users on unpatched devices from browsing until they update). Disabling JavaScript would reduce the DOM attack surface but breaks most modern sites and is generally impractical.