What is the CVSS score of CVE-2026-13967?

CVE-2026-13967 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Google Chrome are affected by CVE-2026-13967?

A remote code execution vulnerability in Google Chrome (CVE-2026-13967, CVSS 8.8) affects all users with versions prior to 150.0.7871.47 and could allow attackers to compromise endpoints and access…. A patch is available.

How to fix or mitigate CVE-2026-13967?

Within 24 hours: Inventory Chrome versions across all endpoints; issue urgent security bulletin to all users with instructions to update to version 150.0.7871.47 or later. Within 7 days: Deploy patches through standard patch management channels; prioritize corporate-managed systems and development environments. Within 30 days: Audit compliance via endpoint management tools to confirm 100% deployment; document in change management and security incident log.

Google Chrome CVE-2026-13967

EUVD-2026-40655 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-30 chrome-cve-admin@google.com

GHSA-pwfh-44rh-2cj8

RCE Buffer Overflow Google Memory Corruption Red Hat Suse

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote crafted page (AV:N), no auth (PR:N), but requires the victim to open the page (UI:R); renderer-sandbox code execution keeps scope unchanged (S:U) with full in-process C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 15:30 vuln.today

CVSS changed

Jul 01, 2026 - 15:22 NVD

8.8 (HIGH)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

HIGH 8.8

DescriptionCVE.org

Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.

Technical ContextAI

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome and all Chromium-based browsers. The referenced CWE is CWE-843 (Access of Resource Using Incompatible Type, i.e. 'type confusion'), a classic V8 root-cause class where the engine operates on an object assuming one type while it is actually another, producing out-of-bounds heap access; the vendor description characterizes the concrete effect as a heap buffer overflow. Type confusion and heap overflows in V8 typically originate in JIT compiler optimizations or object shape/map handling and yield attacker-controlled reads/writes on the heap. Notably, the description scopes code execution to 'inside a sandbox' - the compromised renderer process, not a full sandbox escape - so on its own it grants control of the V8/renderer context rather than the underlying OS.

RemediationAI

Vendor-released patch: update Google Chrome to 150.0.7871.47 or later on all desktop platforms, then fully restart the browser so the new V8 build is loaded (Chrome auto-updates, but the update only takes effect after relaunch). See the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Users of other Chromium-based browsers should apply their vendor's build that incorporates the corresponding V8 fix. If immediate patching is not possible, compensating controls include enabling Chrome's Enhanced Safe Browsing (adds warning/blocking of malicious pages, at the cost of sending more browsing telemetry to Google) and disabling the V8 JIT via enterprise policy or the --js-flags="--jitless" launch flag, which shrinks the JIT attack surface but degrades JavaScript performance on heavy web apps. Enterprise fleets can enforce the minimum version through the browser update policy to guarantee coverage.