What is the CVSS score of CVE-2026-13928?

CVE-2026-13928 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13928?

Google Chrome privilege escalation vulnerability (CVE-2026-13928) affecting all desktop versions prior to 150.0.7871.47 enables attackers to escalate system privileges through malicious webpages,…. A patch is available.

How to fix or mitigate CVE-2026-13928?

Within 24 hours, identify all Chrome desktop installations and their current versions through your device management system. Within 7 days, deploy Chrome version 150.0.7871.47 or later to 100% of managed endpoints via MDM or centralized deployment; enforce a policy blocking execution of older versions. Within 30 days, conduct a full remediation verification sweep and audit system logs for indicators of exploit attempts during the vulnerability window.

Google Chrome CVE-2026-13928

EUVD-2026-40614 HIGH

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-4rw3-94hg-v93c

Privilege Escalation Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Reachable via a crafted web page with no attacker auth (AV:N/PR:N) but needs the victim to open it (UI:R); total technical impact yields C:H/I:H/A:H, scope unchanged.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:50 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Privilege escalation in Google Chrome desktop versions prior to 150.0.7871.47 lets a remote attacker escalate privileges when a victim opens a crafted HTML page, stemming from insufficient input validation in the Enterprise component. Chromium rated the flaw Medium severity, though the assigned CVSS of 8.8 reflects high confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The affected software is the Google Chrome browser (cpe:2.3:a:google:chrome), specifically an 'Enterprise' feature/component as named in the CVE. The root cause is classified as CWE-20 (Improper Input Validation): the browser insufficiently validates untrusted input delivered through web content, allowing a maliciously crafted HTML page to drive the browser into an unintended, higher-privilege state. Because the flaw is reachable purely through rendering attacker-controlled HTML, it lives in the content-handling path exposed to any visited website, which is why the CVSS attack vector is network with low complexity.

RemediationAI

Vendor-released patch: upgrade Google Chrome to 150.0.7871.47 or later via the Stable channel update announced at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html; on Linux, apply the corresponding SUSE/distribution package update. Since Chrome auto-updates by default, verify updates are not disabled by enterprise policy and force a relaunch to apply the fix, then confirm the version under chrome://settings/help across the fleet. If patching must be briefly deferred, reduce exposure by restricting browsing to trusted sites, enabling stricter site isolation and Enhanced Safe Browsing, and using enterprise policies to limit untrusted web content - with the trade-off that these controls reduce but do not eliminate risk since exploitation only requires visiting a crafted page. No workaround is a substitute for the update.