CVE-2026-13925: Inappropriate implementation in Google Chrome
CVE-2026-13925 is a medium severity vulnerability in Google Chrome on Windows versions prior to 150.0.7871.47. It involves an inappropriate implementation in the Downloads component that allows a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability requires user interaction and affects desktop Chrome on Windows. A fix is indicated by the version 150.0.7871.47, but explicit patch status is not confirmed in the vendor advisory.
AI Analysis
Technical Summary
This vulnerability in Google Chrome's Downloads feature on Windows allows remote code execution when a user is tricked into performing certain UI gestures on a maliciously crafted HTML page. The issue affects versions prior to 150.0.7871.47. Although the CVE does not provide a CVSS score, the Chromium security severity is rated medium. The vendor advisory linked references a stable channel update but does not explicitly confirm patch availability or remediation details.
Potential Impact
Successful exploitation can lead to arbitrary code execution on the affected system, potentially allowing an attacker to run code with the privileges of the user. This requires user interaction through specific UI gestures, limiting the ease of exploitation. There are no known exploits in the wild at this time.
Mitigation Recommendations
Users should update Google Chrome on Windows to version 150.0.7871.47 or later to address this vulnerability. Patch status is not explicitly confirmed in the vendor advisory, so users should verify update installation. No additional mitigation steps are specified by the vendor.
CVE-2026-13925: Inappropriate implementation in Google Chrome
Description
CVE-2026-13925 is a medium severity vulnerability in Google Chrome on Windows versions prior to 150.0.7871.47. It involves an inappropriate implementation in the Downloads component that allows a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page. The vulnerability requires user interaction and affects desktop Chrome on Windows. A fix is indicated by the version 150.0.7871.47, but explicit patch status is not confirmed in the vendor advisory.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Google Chrome's Downloads feature on Windows allows remote code execution when a user is tricked into performing certain UI gestures on a maliciously crafted HTML page. The issue affects versions prior to 150.0.7871.47. Although the CVE does not provide a CVSS score, the Chromium security severity is rated medium. The vendor advisory linked references a stable channel update but does not explicitly confirm patch availability or remediation details.
Potential Impact
Successful exploitation can lead to arbitrary code execution on the affected system, potentially allowing an attacker to run code with the privileges of the user. This requires user interaction through specific UI gestures, limiting the ease of exploitation. There are no known exploits in the wild at this time.
Mitigation Recommendations
Users should update Google Chrome on Windows to version 150.0.7871.47 or later to address this vulnerability. Patch status is not explicitly confirmed in the vendor advisory, so users should verify update installation. No additional mitigation steps are specified by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-06-29T23:03:53.615Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html","vendor":"Google"}]
Threat ID: 6a444c2027e9c7971985cd0d
Added to database: 06/30/2026, 23:07:12 UTC
Last enriched: 07/01/2026, 03:07:09 UTC
Last updated: 07/01/2026, 03:07:09 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.