What is the CVSS score of CVE-2026-13970?

CVE-2026-13970 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-13970?

Yes, a patch is available for CVE-2026-13970. Update the affected software to the latest version immediately.

Google Chrome CVE-2026-13970

EUVD-2026-40658 MEDIUM

Use of Uninitialized Variable (CWE-457)

2026-06-30 chrome-cve-admin@google.com

GHSA-4fm8-wg27-q6xr

Information Disclosure Google Red Hat Suse

5.3

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

vuln.today AI

5.3 MEDIUM

AC:H reflects mandatory renderer pre-compromise; C:H for arbitrary process memory read; no integrity or availability impact applies.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.0 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 02:32 vuln.today

CVSS changed

Jul 01, 2026 - 02:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 30, 2026 - 23:17 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 30, 2026 - 23:17 cve.org

MEDIUM 5.3

DescriptionCVE.org

Uninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Uninitialized memory exposure in Google Chrome's Media component allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47, across desktop platforms. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation requires a chained renderer compromise, significantly constraining real-world risk despite the high confidentiality impact rating.

Technical ContextAI

CWE-457 (Use of Uninitialized Variable) describes a class of memory-safety defect where allocated memory is read before being written, potentially exposing stale heap or stack contents from prior allocations. In Chrome's Media subsystem - which handles decoding and processing of audio and video content - an uninitialized buffer read can surface arbitrary bytes from the renderer process's address space when a specially crafted media element or HTML page is parsed. Chrome's multi-process architecture means this flaw is exercised within the renderer sandbox, so an attacker must first achieve renderer-process code execution through a separate vulnerability before this information-disclosure bug becomes reachable. The affected CPE, per EUVD data, is Chrome versions below 150.0.7871.47.

RemediationAI

Upgrade to Google Chrome version 150.0.7871.47 or later, available via Chrome's built-in auto-update mechanism or directly from the Chrome releases blog at chromereleases.googleblog.com (June 2026 Stable Channel update). Because exploitation requires a pre-compromised renderer process, organizations that cannot immediately patch should focus on ensuring no other unpatched renderer vulnerabilities are present, as those are the necessary precursor. Enabling Chrome's Enhanced Safe Browsing can reduce the likelihood of landing on attacker-controlled pages. For enterprise deployments, enforcing Chrome version policy via Google Admin Console or endpoint management tooling will ensure fleet-wide coverage. No separate workaround for the Media component itself is available without patching.