CVE-2026-13793

Received Received - Intake

Insufficient Policy Enforcement in SVG in Google Chrome

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: Chrome

Description

Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-13793

EUVD

EUVD-2026-40479

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	150.0.7871.47

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is due to insufficient policy enforcement in the SVG (Scalable Vector Graphics) implementation in Google Chrome versions prior to 150.0.7871.47.

It allows a remote attacker to leak cross-origin data by crafting a malicious HTML page that exploits this weakness.

Impact Analysis

An attacker exploiting this vulnerability could access data from other origins that should be protected, leading to potential leakage of sensitive information.

This could compromise user privacy and security by exposing data that is normally restricted by the browser's same-origin policy.

Hi! I’m here to help you understand CVE-2026-13793. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70