What is the CVSS score of CVE-2026-13920?

CVE-2026-13920 has a contested CVSS base score of 9.6 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Google Chrome are affected by CVE-2026-13920?

Google Chrome on Windows contains a critical vulnerability (CVE-2026-13920) that could allow attackers to escalate from a compromised browser to full system control.. A patch is available.

How to fix or mitigate CVE-2026-13920?

Within 24 hours: Identify and document all Windows systems running Google Chrome versions before 150.0.7871.47. Within 7 days: Deploy Chrome 150.0.7871.47 or later to pilot groups to validate compatibility. Within 30 days: Complete full deployment across all Chrome endpoints.

Google Chrome CVE-2026-13920

EUVD-2026-40606 CRITICAL

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-f7h6-pg9w-wwgv

Information Disclosure Google Microsoft Red Hat Suse

Critical

Disputed · 9.6 Vendor: google

Severity by source

Sources disagree (Medium–Critical)

Vendor (google) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

7.6 HIGH

Requires a pre-compromised renderer (PR:H) and a chained non-trivial condition (AC:H) plus user interaction (UI:R); successful escape crosses the sandbox boundary (S:C) with full browser-process impact.

3.1 AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

9.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 18:24 vuln.today

CVSS changed

Jul 01, 2026 - 18:22 NVD

9.6 (None) 9.6 (CRITICAL)

CVE Published

Jun 30, 2026 - 23:17 cve.org

CRITICAL 9.6

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that abuses insufficient input validation in the Media component. Google rates the Chromium security severity as Medium and a fix is shipped in the stable channel, but no public exploit has been identified and EPSS exploitation probability is low at 0.21%. The high 9.6 CVSS reflects the total system compromise possible once chained, not standalone exploitability.

Technical ContextAI

The flaw lives in Chrome's Media subsystem, which handles decoding and playback of audio/video content delivered through web pages. Rooted in CWE-20 (Improper Input Validation), the component fails to adequately validate untrusted input crossing the renderer-to-browser boundary, so a controlled renderer can pass malformed data that the more-privileged browser process mishandles. Because Chrome enforces a multi-process sandbox where renderers are low-privilege, a Media parsing weakness reachable from the renderer becomes a sandbox-escape primitive. The affected build is the Windows desktop stable channel prior to 150.0.7871.47; the fix landed via the 2026-06 Stable Channel Update tracked in Chromium issue 511722559.

RemediationAI

Vendor-released patch: update Google Chrome for Windows to 150.0.7871.47 or later via the Stable Channel Update described at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; trigger Chrome's built-in updater (chrome://settings/help) and relaunch, or push the update through enterprise management (Google Update / Chrome Browser Cloud Management) to ensure the browser process actually restarts to apply the fix. Because the bug requires a pre-compromised renderer, defense-in-depth against the first-stage renderer RCE also reduces risk: keep site isolation enabled (default) and consider enabling the Windows renderer code-integrity and stricter sandbox policies. As an interim compensating control before patch rollout, restrict or block untrusted media-heavy sites and enforce automatic updates so no user runs a build below 150.0.7871.47; note that blocking media content degrades legitimate browsing and is only a stopgap.