What is the CVSS score of CVE-2026-13961?

CVE-2026-13961 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13961?

Yes, a patch is available for CVE-2026-13961. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13961

EUVD-2026-40649 MEDIUM

Improper Input Validation (CWE-20)

2026-06-30 chrome-cve-admin@google.com

GHSA-hqg2-xpfr-4wgv

Information Disclosure Google Microsoft Red Hat Suse

5.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

Matches vendor-provided vector: network delivery, high complexity due to required UI gesture sequencing, no auth needed, user interaction required, confidentiality-only impact with no integrity or availability effect.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:31 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Process memory disclosure in Google Chrome DevTools on Windows (versions prior to 150.0.7871.47) allows a remote attacker to read potentially sensitive data from browser process memory by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw stems from insufficient input validation (CWE-20) within the DevTools subsystem and is limited to the Windows platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality impact is rated High by NVD.

Technical ContextAI

The affected component is Chrome's DevTools - the built-in browser developer tooling exposed via F12 or right-click Inspect. DevTools operates with elevated access to browser internals including process memory, making input-validation failures (CWE-20) in this surface particularly sensitive. CWE-20 describes failure to properly validate untrusted input before processing, which in this context allows a crafted HTML page to supply malformed or unexpected content that DevTools processes without adequate sanitization. The scope is explicitly limited to Chrome on Windows (per the NVD description), suggesting the vulnerable code path or memory layout behavior is Windows-specific. The affected CPE range covers all Chrome releases below 150.0.7871.47.

RemediationAI

The primary fix is to update Google Chrome on Windows to version 150.0.7871.47 or later, available through Chrome's built-in update mechanism (Settings → Help → About Google Chrome) or via enterprise deployment tools. The vendor advisory confirming the patch is at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As a compensating control prior to patching, organizations can restrict access to DevTools via enterprise policy (setting DeveloperToolsAvailability to 2 in Chrome Group Policy), which prevents the vulnerable code path from being reachable; note this will block legitimate developer workflows. Additionally, user awareness guidance to avoid performing unusual UI interactions on unfamiliar web pages reduces the social-engineering vector. No workaround fully mitigates the risk without the patch.