CVE-2026-13938 is an integer overflow vulnerability in the Fonts handling of Google Chrome versions before 150.0.7871.47. Exploitation involves a remote attacker crafting a malicious HTML page that triggers an out-of-bounds memory write, potentially leading to arbitrary code execution or other severe impacts. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vendor advisory linked indicates a stable channel update addressing this issue in version 150.0.7871.47.

Successful exploitation can lead to arbitrary code execution or memory corruption due to out-of-bounds writes, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is remotely exploitable without privileges but requires user interaction (visiting a crafted HTML page).

A fix is available in Google Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for detailed update instructions.