CVE-2026-13888

HighCVSS 8.8

Published: 30/06/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.35%

27th percentile — higher than 27% of all known CVEs

Summary

A use-after-free vulnerability in Extensions in Google Chrome prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Risk Assessment

The risk involves remote code execution by an attacker, potentially leading to data compromise or browser takeover despite sandbox restrictions.

Recommendation

Immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.

Original NVD description (English source)

Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)