CVE Intelligence
Analysis AI-assisted

CVE-2026-13775: Google Chrome GPU Use-After-Free Sandbox Escape

CVE-2026-13775 is a use-after-free flaw in the GPU component of Google Chrome prior to 150.0.7871.47. According to the record, an attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The NVD lists a CVSS 3.1 base score of 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13775 is a use-after-free (CWE-416) vulnerability in the GPU component of Google Chrome. The record states it affects Chrome versions prior to 150.0.7871.47 and was published on 2026-06-30. The Chromium security severity is rated Critical.

Impact

The flaw is described as allowing a remote attacker who had already compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The NVD base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network attack vector, low complexity, no privileges or user interaction required, and high confidentiality, integrity and availability impact as scored by NVD. A second score of 9.6 from another provider is also listed.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47.

No fixed-version field is populated in the record, but the affected range implies that 150.0.7871.47 and later are not affected according to the vendor description.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00319 (percentile 0.23126) as of the record date.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, as referenced in the Chrome stable channel update.
  • Confirm that managed browser deployments and embedded Chromium-based applications are updated, since they may ship their own builds.
  • Restrict exposure of untrusted web content where operationally feasible until updates are applied.

Detection guidance

  • Inventory installed Chrome versions across endpoints and flag any build below 150.0.7871.47.
  • Monitor for unexpected Chrome renderer crashes or GPU process restarts as a general indicator of memory-corruption attempts; this is a high-level signal, not a confirmed indicator for this CVE.

Limitations of the available information

The record does not include detailed technical analysis, exploitation prerequisites beyond the renderer compromise, or confirmed indicators of compromise. The Chromium issue tracker entry is listed but its content was not provided. No CVSS vector details beyond the NVD entry are available for the second score.

Frequently asked questions

What does CVE-2026-13775 affect?

The record lists Google Chrome versions prior to 150.0.7871.47.

Is this CVE being actively exploited?

It is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Chrome to 150.0.7871.47 or later and verify that Chromium-based embedded applications are also updated.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.