What is the CVSS score of CVE-2026-13929?

CVE-2026-13929 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13929?

Yes, a patch is available for CVE-2026-13929. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-13929

EUVD-2026-40615 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-9q58-8m4g-h5mx

Authentication Bypass Google Red Hat Suse

5.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

5.5 MEDIUM

Local file delivery mandates physical or existing device access (AV:L); victim must open the malicious file (UI:R); no prior privileges required (PR:N); only navigation integrity is impacted (I:H), with no confidentiality or availability effect.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

3.9 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:27 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

5.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.

Technical ContextAI

The vulnerability originates in DevTools, Chrome's built-in developer tooling layer, specifically its implementation on Android. CWE-20 (Improper Input Validation) as the root cause class indicates that DevTools fails to adequately validate or sanitize inputs encountered when processing certain file types, causing navigation policy enforcement logic to be bypassed. On Android, Chrome DevTools can interact with local file system resources and exposes debugging surfaces that interact with browser navigation controls; the policy enforcement gap here allows a specially crafted file to manipulate navigation state in ways the policy layer was designed to block. Affected CPE aligns with Chrome for Android prior to 150.0.7871.47 as confirmed by the EUVD affected-version range.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in update mechanism; this is the vendor-confirmed fix per the stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No official workaround is documented. As a compensating control prior to patching in managed enterprise environments, administrators can restrict DevTools access on Android via Chrome enterprise policy (e.g., disabling remote debugging or restricting file access permissions), which reduces the attack surface but may impair developer workflows. Given the local attack vector and low EPSS, prioritize this patch within the normal monthly patching cycle rather than as an out-of-band emergency update.