CVE-2026-13967 - Vulnerability Details

Description

Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Published: 2026-06-30

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A heap buffer overflow exists in the V8 JavaScript engine of Google Chrome. The overflow is triggered by a type-mismatch (CWE-843) when a crafted HTML page is rendered, allowing an attacker to run arbitrary code within the browser’s sandboxed rendering process. The attacker is confined to the sandbox.

Affected Systems

Google Chrome versions earlier than 150.0.7871.47 are vulnerable. The flaw is present in the V8 engine used in the Chrome browser supported by Chrome.

Risk and Exploitability

The likely attack vector is a malicious web page loaded by the victim; based on the description, it is inferred that no local privileges or authentication are required. The EPSS score of <1% indicates a low but nonzero probability of exploitation. With a CVSS score of 8.8, the issue is rated high by CVSS, but Chromium rates it as Medium severity. The vulnerability allows remote code execution within the sandbox, and it is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.47,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update Google Chrome to version 150.0.7871.47 or later.
Enable automatic browser updates on all devices so the patch is applied promptly.
Configure enterprise or browser policies to block untrusted HTML or disable third‑party content until the vulnerability is addressed.

Generated by OpenCVE AI on July 15, 2026 at 23:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00453.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/513751951

History

Thu, 16 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Title		Google Chrome V8 Heap Buffer Overflow Enables Remote Code Execution

Tue, 14 Jul 2026 12:00:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in Chrome V8 Allows Remote Code Execution in Sandbox

Mon, 13 Jul 2026 05:30:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in Chrome V8 Allows Remote Code Execution in Sandbox

Sun, 12 Jul 2026 10:45:00 +0000

Type	Values Removed	Values Added
Title	V8 Heap Buffer Overflow Allowing Remote Code Execution via Crafted HTML

Fri, 10 Jul 2026 18:15:00 +0000

Type	Values Removed	Values Added
Title		V8 Heap Buffer Overflow Allowing Remote Code Execution via Crafted HTML

Thu, 09 Jul 2026 15:15:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in V8 Enables Remote Code Execution via Malicious HTML

Tue, 07 Jul 2026 21:45:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in V8 Enables Remote Code Execution via Malicious HTML

Mon, 06 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
Title	Chrome V8 Heap Buffer Overflow Enables Remote Code Execution

Mon, 06 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title		Chrome V8 Heap Buffer Overflow Enables Remote Code Execution

Sun, 05 Jul 2026 11:45:00 +0000

Type	Values Removed	Values Added
Title	V8 Heap Buffer Overflow Enabling Remote Code Execution

Sat, 04 Jul 2026 23:15:00 +0000

Type	Values Removed	Values Added
Title		V8 Heap Buffer Overflow Enabling Remote Code Execution

Sat, 04 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Title	Chrome V8 Heap Overflow Enables Remote Code Execution

Sat, 04 Jul 2026 04:15:00 +0000

Type	Values Removed	Values Added
Title		Chrome V8 Heap Overflow Enables Remote Code Execution

Fri, 03 Jul 2026 17:00:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in V8 Engine Enabling Remote Code Execution via Crafted HTML

Fri, 03 Jul 2026 02:30:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in V8 Engine Enabling Remote Code Execution via Crafted HTML

Thu, 02 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in V8 Enabling RCE via Crafted HTML

Thu, 02 Jul 2026 06:45:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in V8 Enabling RCE via Crafted HTML

Thu, 02 Jul 2026 02:15:00 +0000

Type	Values Removed	Values Added
Title	Remote Code Execution via V8 Heap Buffer Overflow in Google Chrome

Wed, 01 Jul 2026 20:45:00 +0000

Type	Values Removed	Values Added
Title		Remote Code Execution via V8 Heap Buffer Overflow in Google Chrome

Wed, 01 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in V8 Allows Remote Code Execution via Crafted HTML

Wed, 01 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 12:30:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in V8 Allows Remote Code Execution via Crafted HTML

Wed, 01 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 08:00:00 +0000

Type	Values Removed	Values Added
Title	Heap Buffer Overflow in V8 Engine Enables Remote Code Execution via Crafted HTML

Wed, 01 Jul 2026 03:00:00 +0000

Type	Values Removed	Values Added
Title		Heap Buffer Overflow in V8 Engine Enables Remote Code Execution via Crafted HTML

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses		CWE-843
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/513751951

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:38:39.195Z

Updated: 2026-07-02T03:56:52.638Z

Reserved: 2026-06-29T23:04:03.940Z

Link: CVE-2026-13967

Vulnrichment

Updated: 2026-07-01T14:16:37.549Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-16T00:00:11Z

Weaknesses

CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object