What is the CVSS score of CVE-2026-13938?

CVE-2026-13938 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13938?

Google Chrome users across the organization are vulnerable to remote code execution attacks through malicious webpages.. A patch is available.

How to fix or mitigate CVE-2026-13938?

Within 24 hours, enable Chrome auto-update or deploy version 150.0.7871.47 or later to all endpoints and notify users of the critical update requirement. Within 7 days, verify patch compliance across all systems and confirm no devices remain on vulnerable versions. Within 30 days, review browser logs and security telemetry for indicators of exploitation attempts or unusual renderer process behavior.

Google Chrome CVE-2026-13938

EUVD-2026-40624 HIGH

External Control of Assumed-Immutable Web Parameter (CWE-472)

2026-06-30 chrome-cve-admin@google.com

GHSA-mpgh-vpq3-4c7p

Buffer Overflow Google Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-delivered via a crafted page with no privileges (PR:N) but mandatory user interaction (UI:R); memory-corruption OOB write supports high C/I/A within the renderer (S:U).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:48 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).

Technical ContextAI

The vulnerability lives in Chrome's font-handling subsystem, which parses and shapes font data (e.g., glyph tables, metrics) as part of rendering web content. An arithmetic operation on attacker-influenced size/count values overflows an integer, producing an undersized or miscalculated allocation or index that the code then writes past, yielding an out-of-bounds write on the heap. The input labels the root cause CWE-472 (External Control of Assumed-Immutable Web Parameter), which does not match the described integer-overflow-to-OOB-write pattern (more consistent with CWE-190/CWE-787); this CWE assignment appears inaccurate and should be treated cautiously. The affected code is reached through the standard renderer, so any page delivering the malicious font-triggering markup can exercise it. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*.

RemediationAI

Vendor-released patch: 150.0.7871.47 - update Google Chrome to 150.0.7871.47 or later via the Stable channel and restart the browser to apply it, per https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. In managed environments, push the update through your enterprise deployment tooling and confirm the effective version, since Chrome's silent-update mechanism can be disabled by policy. For Chromium-based derivatives, apply the corresponding vendor build once available. Until updated, reduce exposure by limiting browsing to trusted sites and enabling strict Site Isolation (default in Chrome) to keep renderer compromise contained; these are only partial mitigations because the trigger is ordinary web content, so patching is the reliable control.