CVE-2026-13828 - Vulnerability Details

Description

Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Published: 2026-06-30

Score: 6.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in Google Chrome Enterprise before version 150.0.7871.47 allows a remote attacker to read potentially sensitive data from the browser's process memory by loading a specially crafted HTML page. This leads to information disclosure and is identified as an access-control weakness (CWE-284). The result is the exposure of confidential data that is processed by Chrome, severity label from the Chromium security team.

Affected Systems

All installations of Google Chrome Enterprise running any Chrome version older than 150.0.7871.47 are affected. The issue does not apply to later releases that incorporate the fix.

Risk and Exploitability

The vulnerability can be triggered by a malicious or compromised web page that, giving a remote attacker the ability to read process memory. The 6.5 suggests a moderate‑to‑high risk of information disclosure, while the EPSS score of < 1% indicates a very low but non‑zero likelihood of exploitation currently not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[0,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade all Chrome Enterprise installations to version 150.0.7871.47 or later.
Configure Chrome Enterprise policies to automatically deploy the latest security updates.
Monitor web content for malicious or suspicious HTML and block or alert on unexpected scripts.

Generated by OpenCVE AI on July 31, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00274.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513399832

History

Fri, 31 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Process Memory Disclosure via Crafted HTML

Sun, 26 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title	Remote Information Disclosure via Process Memory Leak in Chrome Enterprise

Wed, 22 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title		Remote Information Disclosure via Process Memory Leak in Chrome Enterprise

Thu, 16 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Process Memory Disclosure via Crafted HTML Page

Tue, 14 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Process Memory Disclosure via Crafted HTML Page

Sun, 12 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title	Remote Information Disclosure via Process Memory Read in Chrome Enterprise

Sat, 11 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title		Remote Information Disclosure via Process Memory Read in Chrome Enterprise

Fri, 10 Jul 2026 18:45:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Vulnerability Enables Memory Disclosure via Crafted HTML

Thu, 09 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Vulnerability Enables Memory Disclosure via Crafted HTML

Wed, 08 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Process Memory Disclosure via Crafted HTML

Tue, 07 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Process Memory Disclosure via Crafted HTML

Mon, 06 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Title	Process Memory Leak Leads to Remote Information Disclosure in Chrome Enterprise

Mon, 06 Jul 2026 04:00:00 +0000

Type	Values Removed	Values Added
Title		Process Memory Leak Leads to Remote Information Disclosure in Chrome Enterprise

Sun, 05 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Process Memory Disclosure via Crafted HTML Page

Sat, 04 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Process Memory Disclosure via Crafted HTML Page

Fri, 03 Jul 2026 13:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Remote Memory Disclosure via Crafted HTML Page

Fri, 03 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Remote Memory Disclosure via Crafted HTML Page

Thu, 02 Jul 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Memory Disclosure Vulnerability

Thu, 02 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Memory Disclosure Vulnerability

Wed, 01 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title	Remote Information Disclosure Vulnerability in Google Chrome Enterprise Prior to 150.0.7871.47

Wed, 01 Jul 2026 15:00:00 +0000

Type	Values Removed	Values Added
Title		Remote Information Disclosure Vulnerability in Google Chrome Enterprise Prior to 150.0.7871.47

Wed, 01 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title	Chrome Enterprise Memory Disclosure via Crafted HTML Page
Weaknesses	CWE-200

Wed, 01 Jul 2026 07:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title		Chrome Enterprise Memory Disclosure via Crafted HTML Page
Weaknesses		CWE-200

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513399832

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:37:48.203Z

Updated: 2026-07-01T01:28:50.188Z

Reserved: 2026-06-29T23:03:27.710Z

Link: CVE-2026-13828

Vulnrichment

Updated: 2026-07-01T01:28:41.837Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-31T16:30:17Z

Weaknesses

CWE-284
Improper Access Control

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object