What is the CVSS score of CVE-2026-13958?

CVE-2026-13958 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13958?

Yes, a patch is available for CVE-2026-13958. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13958

EUVD-2026-40646 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-w7cm-fh2f-3jph

Information Disclosure Google Microsoft Red Hat Suse

6.5

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

AV:N and UI:R reflect webpage delivery requiring one user visit; C:H for uncontrolled process memory read; I:N and A:N as no write or crash capability exists.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:31 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a memory-safety flaw where a buffer or variable is read before being explicitly written, allowing residual heap or stack data from prior allocations to leak. In Chrome, this flaw resides in the codec processing layer - the subsystem responsible for decoding audio and video media embedded in HTML pages. When the renderer process decodes attacker-supplied media, it reads uninitialized memory, which may contain sensitive data from prior allocations within the same process space. On Windows, heap memory layout and the absence of mandatory zeroing on allocation make this class of bug particularly exploitable for information leakage. The affected product is confirmed by EUVD-2026-40646 and the vendor advisory as Google Chrome for Windows, versions prior to 150.0.7871.47.

RemediationAI

Update Google Chrome on Windows to version 150.0.7871.47 or later, which is confirmed to contain the vendor-released patch per the official advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome auto-updates by default; users and administrators can verify or trigger the update via Chrome menu → Help → About Google Chrome. Enterprise administrators should push the update via Chrome Enterprise management or Google Update policy. As a compensating control prior to patching, organizations can enforce Chrome Enterprise URL allowlists or blocklists to restrict navigation to untrusted sites, reducing the attack surface; however, this does not eliminate risk for users who legitimately browse external content. Disabling codec functionality is not a practical workaround given its pervasive use in modern web content.