What is the CVSS score of CVE-2026-13930?

CVE-2026-13930 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13930?

Yes, a patch is available for CVE-2026-13930. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13930

EUVD-2026-40616 MEDIUM

Client-Side Enforcement of Server-Side Security (CWE-602)

2026-06-30 chrome-cve-admin@google.com

GHSA-5rqg-9mjf-c7j6

Authentication Bypass Google Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

vuln.today AI

6.5 MEDIUM

Network delivery via crafted HTML page requires no attacker auth (PR:N) but mandates victim interaction (UI:R); integrity-only impact reflects navigation policy bypass with no data disclosure or availability loss.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:28 vuln.today

CVSS changed

Jul 01, 2026 - 17:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host crafted HTML page on attacker-controlled server

Delivery

Deliver phishing link to victim

Exploit

Victim opens page in Chrome prior to 150.0.7871.47

Execution

Crafted page triggers Actor policy bypass

Impact

Browser navigates to restricted destination

Access

Host crafted HTML page on attacker-controlled server

Delivery

Deliver phishing link to victim

Exploit

Victim opens page in Chrome prior to 150.0.7871.47

Execution

Crafted page triggers Actor policy bypass

Impact

Browser navigates to restricted destination

Vulnerability AssessmentAI

Exploitation	The target must be running Google Chrome on a desktop platform (Windows, macOS, or Linux) at a version strictly below 150.0.7871.47. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting network reachability, low attack complexity, no required privileges, and mandatory user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker hosts a crafted HTML page designed to exploit insufficient policy enforcement in Chrome's Actor component, triggering navigation to a destination that should be blocked by the browser's restriction policies. The victim, running Chrome prior to 150.0.7871.47, is directed to the malicious page via a phishing email or compromised link, after which the crafted page silently bypasses the navigation restriction and redirects the browser to an unauthorized resource. …
Remediation	The primary remediation is upgrading Google Chrome to version 150.0.7871.47 or later, which contains the vendor-released patch as confirmed by the Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. … Detailed patch versions, workarounds, and compensating controls in full report.