What is the CVSS score of CVE-2026-13925?

CVE-2026-13925 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13925?

Google Chrome on Windows versions before 150.0.7871.47 contain a remote code execution vulnerability allowing attackers to fully compromise affected systems by directing users to a malicious web page…. A patch is available.

How to fix or mitigate CVE-2026-13925?

Within 24 hours, audit deployment systems to identify all Windows devices running Chrome before version 150.0.7871.47 and establish patch priority targeting high-value endpoints. Within 7 days, deploy Chrome 150.0.7871.47 or later across Windows endpoints using your standard update mechanism or MDM tools, prioritizing systems handling sensitive data. Within 30 days, verify patch deployment completion through endpoint telemetry and confirm any unpatched systems have alternative protections in place.

Google Chrome CVE-2026-13925

EUVD-2026-40611 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-xq83-9w8q-cq9h

RCE Google Microsoft Red Hat

7.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Network-delivered via web page (AV:N) but gated by required specific UI gestures and difficult conditions (UI:R, AC:H); no auth needed (PR:N); arbitrary code execution yields total C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:51 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome on Windows before 150.0.7871.47 allows a remote attacker to run arbitrary code after luring a victim to a crafted HTML page and coercing specific UI gestures via an inappropriate implementation in the Downloads component. Rated Medium by Chromium but scored CVSS 7.5 due to full compromise potential; no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile). SSVC lists exploitation as none, so this is a patch-in-normal-cycle item rather than an emergency.

Technical ContextAI

The flaw lives in Chrome's Downloads subsystem on the Windows platform, where an 'inappropriate implementation' (classified upstream as CWE-20, Improper Input Validation) permits attacker-influenced content to drive behavior it should not. Chrome's download flow handles file origin metadata, save prompts, and disk writes; when combined with attacker-crafted HTML and misleading UI interactions (such as tricking the user into clicking, dragging, or confirming a download dialog), the download handling can be manipulated to place or execute attacker-controlled code. The affected component is identified by CPE cpe:2.3:a:google:chrome:*, and the root cause class - improper input validation - means the browser trusts or mishandles data it should have sanitized or constrained before acting on it.

RemediationAI

Update Google Chrome on Windows to version 150.0.7871.47 or later - Vendor-released patch: 150.0.7871.47, distributed through Chrome's Stable channel auto-update (verify via chrome://settings/help and relaunch to apply). Enterprises using managed Chrome should confirm the update is not being pinned or delayed by policy and push the pinned target version through their update management (Google Update / admx policy). Consult the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Until the update is deployed, compensating controls include user awareness against unexpected download prompts and drag-to-download interactions on untrusted sites, and - where feasible - restricting or monitoring browser file downloads via enterprise policy (e.g., download restrictions / DownloadRestrictions policy), accepting the trade-off that aggressive download blocking can disrupt legitimate workflows. Because exploitation requires user gestures, disabling automatic downloads and enforcing 'ask where to save each file' reduces the odds of the required interaction being completed unnoticed.