What is the CVSS score of CVE-2026-13927?

CVE-2026-13927 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Google Chrome are affected by CVE-2026-13927?

Google Chrome for Android before version 150.0.7871.47 contains a privilege escalation vulnerability exposing Android devices to local compromise; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate CVE-2026-13927?

Within 24 hours, initiate deployment of Google Chrome for Android version 150.0.7871.47 or later via MDM to all managed devices, prioritizing business-critical and high-risk user populations. Within 7 days, achieve 100% fleet compliance through MDM enforcement and device compliance reporting; block or uninstall vulnerable versions on managed devices. Within 30 days, conduct post-patch audit of Chrome usage across business applications, verify no compromise occurred, and document patch deployment completion for compliance records.

Google Chrome CVE-2026-13927

EUVD-2026-40613 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-hr79-qv9v-v3rj

Privilege Escalation Google Red Hat

7.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector via a malicious file the user must open (AV:L/UI:R), no prior privileges (PR:N), and privilege escalation yields high C/I/A consistent with SSVC total technical impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:50 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 7.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Local privilege escalation in Google Chrome for Android before 150.0.7871.47 stems from insufficient validation of untrusted input in the browser UI, letting a local attacker who convinces a user to open a malicious file gain elevated privileges. Rated Medium by Chromium but scored CVSS 7.8 (total technical impact per SSVC), with no public exploit identified at time of analysis and a low EPSS of 0.13% (3rd percentile). Google has shipped a fixed Stable channel build.

Technical ContextAI

The flaw is a CWE-20 Improper Input Validation issue in Chrome's user-interface handling of untrusted input, specifically in how the Android build processes a supplied file. Chrome is a Chromium-based browser; the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected application, though the description narrows the impact to the Android platform. Because validation of the untrusted file input is incomplete, a crafted file can drive the UI into an unintended state that crosses a privilege boundary within the browser or the local sandbox model, yielding the escalation described.

RemediationAI

Update Google Chrome to 150.0.7871.47 or later - Vendor-released patch: 150.0.7871.47 - via the Chrome Stable channel update announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; on Android this arrives through the Google Play Store, so ensure automatic updates are enabled and force-update managed fleets via MDM. Until the update is applied, the practical compensating control is to avoid opening untrusted or unexpected files through Chrome and to restrict sideloading of files from unknown sources; because exploitation requires the user to open a malicious file, user-awareness and blocking untrusted downloads meaningfully reduce exposure, at the cost of some workflow friction. No workaround fully substitutes for the patch given the total technical impact.