What is the CVSS score of CVE-2026-13965?

CVE-2026-13965 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13965?

Google Chrome contains a memory vulnerability affecting all versions before 150.0.7871.47 that could allow attackers to execute code on employee systems through malicious web content.. A patch is available.

How to fix or mitigate CVE-2026-13965?

Within 24 hours, alert all stakeholders of the vulnerability and begin testing Chrome 150.0.7871.47 or later in a pilot environment with key business applications. Within 7 days, stage a phased rollout beginning with IT staff, followed by business-critical departments, monitoring system logs for any compatibility issues. Complete full organizational deployment of Chrome 150.0.7871.47 or later within 30 days, and verify that Chrome auto-update policies are enabled to prevent re-exposure to vulnerable versions.

Google Chrome CVE-2026-13965

EUVD-2026-40653 HIGH

Use After Free (CWE-416)

2026-06-30 chrome-cve-admin@google.com

GHSA-v7m7-v7vc-5jm8

RCE Denial Of Service Google Use After Free Memory Corruption Red Hat

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page needs user interaction (UI:R) and no auth (PR:N); low complexity; renderer-confined so scope Unchanged with high C/I/A within the sandboxed process.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

8.8 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 19:45 vuln.today

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).

Technical ContextAI

The flaw is a CWE-416 use-after-free in Oilpan, the C++ garbage-collected heap manager used by Chromium's Blink rendering engine. Oilpan tracks lifetimes of DOM and rendering objects; a use-after-free occurs when a pointer to a freed heap object is subsequently dereferenced, allowing an attacker who controls page content (HTML/JS) to groom the heap, reclaim the freed allocation with attacker-controlled data, and hijack control flow. The affected component (cpe:2.3:a:google:chrome) is the browser renderer process, so successful exploitation yields code execution confined to the renderer sandbox unless separately chained with a sandbox escape.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms; Chrome auto-updates, so ensure the browser is fully closed and relaunched to apply the update, and verify via chrome://settings/help. Enterprises managing Chrome via policy should push the fixed build through their update infrastructure and confirm client versions. Downstream Chromium repackagers (e.g., SUSE) should apply their vendor's corresponding patched package once released. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. As an interim compensating control if patching is delayed, restrict browsing to trusted sites and consider enabling Chrome's Site Isolation (default on) plus stricter enterprise policies limiting untrusted script - with the trade-off of reduced usability; note that disabling JavaScript would significantly break most modern sites and is generally impractical.