Google Chrome CVE-2026-13928

Exploitation requires a victim using Google Chrome desktop earlier than 150.0.7871.47 to actively open or navigate to attacker-controlled HTML content (UI:R) - it is not a fully passive, zero-click attack. No authentication is required on the target side (PR:N per the CVSS vector), and the crafted page can be delivered from any website, malvertising, or link. Limiting factors that reduce realistic risk: the mandatory user interaction of visiting the page, the browser's default auto-update mechanism that closes the window quickly, and SSVC Automatable=no indicating it is not readily scalable/wormable. Enterprise deployments that disable auto-update or run pinned older versions are the most exposed.

Signals here are mixed and worth weighing carefully. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates a high-impact, low-complexity, unauthenticated network flaw that only needs the victim to open a page - a classic drive-by browser risk. Against that, the real-world exploitation signals are all low: EPSS is 0.21% (11th percentile), SSVC records Exploitation=none and Automatable=no (offsetting the network vector, since it still requires a user to visit content), and Chromium itself rated the underlying bug Medium rather than High/Critical. SSVC Technical Impact=total is consistent with the high CVSS impact metrics. Net: this is a genuine browser vulnerability warranting prompt patching, but there is no evidence of active or widespread exploitation, so it should be handled through routine expedited browser update cycles rather than emergency out-of-band response. Note the tension between the Chromium 'Medium' label and the 8.8 CVSS - the 8.8 is driven by the total technical impact, while the Medium reflects exploitation difficulty/context.

An attacker hosts a crafted HTML page (or injects it via a malicious ad or compromised site) and lures a victim running a vulnerable Chrome build to visit it. When the page renders, the improperly validated input drives the browser into an unintended privileged state, giving the attacker elevated capability within the browser context. No public exploit code has been identified at time of analysis, and the attack requires the victim to actually open the page (UI:R).