Intel

CVE-2026-13862

CVE-2026-13862

mediumEPSS 0.3%

Affected

  • debian/chromium 150.0.7871.46-1~deb13u1..*

Description

Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Source: paloalto_rssDebian Security AdvisoriesBSI WID PortalBSI CSAFMicrosoft Security Update GuideNVD (NIST)cvelistv5

Affected operating systems

  • linux

    debian / chromiumtrixie

Metrics

XIEM Effective CVSS
6.5
Source: nvd-v3
EPSS percentile
15.4 %
Elevated — this CVE ranks above at least 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
medium
Priority score
56.33
Exploit maturity
no public PoC known
CVSS v3
6.5
EPSS score
0.3 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-07-11 15:40 UTC

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Initial Analysis2026-07-01 18:22 UTC· nvd@nist.gov
    • CPE Configuration: AND OR *cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* versions up to (excluding) 150.0.7871.47 OR cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
    • Reference Type: Chrome: https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html Types: Vendor Advisory
    • Reference Type: Chrome: https://issues.chromium.org/issues/495897416 Types: Issue Tracking, Permissions Required
  2. CVE Modified2026-07-01 16:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
    • CWE: CWE-693
    • SSVC: {"id":"CVE-2026-13862","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…

Linked advisories