CVE-2026-13791 Code injection in Chrome
An attacker can execute arbitrary code by tricking a user into installing a malicious Chrome extension due to insufficient input validation in the Downloads component.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13791?
CVE-2026-13791 is a high-severity code injection vulnerability in Google Chrome, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)
Weakness: CWE-20
Which versions are affected by CVE-2026-13791?
It affects 1 product.
Products include Google Chrome.
How do I fix CVE-2026-13791?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-13791 being exploited?
There is no known exploitation of CVE-2026-13791 in the wild and no public exploit code.
Other vulnerabilities in Google Chrome
Sources
Also known as DEBIAN-CVE-2026-13791, ECHO-bbe9-1bc4-4de3, GHSA-8qww-3jh8-g7v3, MINI-mp95-27gr-cc9j.