What is the CVSS score of CVE-2026-13969?

CVE-2026-13969 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13969?

Yes, a patch is available for CVE-2026-13969. Update the affected software to the latest version immediately.

Chrome Android CVE-2026-13969

EUVD-2026-40657 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-6933-c37p-mprr

Information Disclosure Google Red Hat Suse

5.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AC:H reflects mandatory renderer pre-compromise; C:H is warranted given arbitrary process memory disclosure; I:N and A:N apply as no write or availability impact exists.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.7 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:32 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

Uninitialized Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory exposure in the UI layer of Google Chrome on Android (prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The vulnerability is CWE-457 (use of uninitialized variable) and is scoped to the Android platform only. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch has been released.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a condition where memory is allocated and referenced before being explicitly initialized, causing unpredictable or attacker-influenced values to be read. In this instance, the flaw resides in Chrome's UI layer on Android - distinct from the V8 JavaScript engine or the network stack - meaning uninitialized stack or heap memory within UI component handling can be surfaced through renderer-to-browser IPC triggered by a crafted HTML page. Chrome's multi-process architecture separates the renderer (sandboxed) from the browser process (privileged), and this vulnerability is exploitable only after the renderer sandbox has already been breached, making it a second-stage information-disclosure primitive. The affected CPE is Google Chrome on Android, all versions prior to 150.0.7871.47.

RemediationAI

Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or the device's standard app update mechanism. This is the vendor-released patch confirmed by the Chrome Releases blog at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires a prior renderer process compromise, organizations with high-risk threat models should additionally ensure Chrome's safe browsing protections and site isolation features are enabled, as these reduce the likelihood of renderer compromise that would make this vulnerability reachable. No workaround is available that eliminates the uninitialized memory condition short of patching; restricting Android device access to untrusted web content can reduce exposure but is operationally impractical for general-purpose devices.