What is the CVSS score of CVE-2026-13949?

CVE-2026-13949 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-13949?

Yes, a patch is available for CVE-2026-13949. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13949

EUVD-2026-40637 MEDIUM

Improper Access Control (CWE-284)

2026-06-30 chrome-cve-admin@google.com

GHSA-v8pr-jqpj-qm7g

Authentication Bypass Google Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-delivered via crafted HTML requiring user visit; no privileges needed; impact is confidentiality-only from process memory read with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:30 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (None) 6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in the Payments component of Google Chrome on Android prior to 150.0.7871.47 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a specially crafted HTML page, making this a user-interaction-dependent, network-delivered information disclosure. No active exploitation is confirmed (SSVC: Exploitation: none; not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the CVSS confidentiality impact is rated High due to the potential for process memory leakage.

Technical ContextAI

The vulnerability resides in Chrome's Payments subsystem on Android, classified under CWE-284 (Improper Access Control). The Payments component in Chrome handles sensitive data such as autofill payment credentials and card details; insufficient policy enforcement means that a renderer-level policy boundary is not correctly applied, permitting a crafted HTML page to read data from process memory that should be isolated. The Android-specific scope suggests the flaw may relate to Chrome's integration with Android's payment APIs or its sandboxed process communication model. Affected CPE resolves to Google Chrome on Android versions below 150.0.7871.47, per EUVD-2026-40637 and the Chrome stable channel advisory.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later - this is the vendor-confirmed patched release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users should ensure automatic updates are enabled via the Google Play Store. As a compensating control prior to patching, disabling or clearing saved payment methods in Chrome settings (Settings → Payment methods) reduces the sensitivity of any memory that could be disclosed, though it does not eliminate the underlying policy enforcement flaw. Restricting Chrome's use of Android payment APIs via enterprise Mobile Device Management (MDM) policy may further reduce exposure in managed environments, though this could break legitimate payment flows. No workarounds eliminate the root vulnerability - patching to 150.0.7871.47 is the only confirmed fix.