CVE Intelligence
Analysis AI-assisted

CVE-2026-13776: Google Chrome Dawn type confusion

CVE-2026-13776 is a type confusion issue in Dawn in Google Chrome versions prior to 150.0.7871.47. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. NVD assigns a CVSS 3.1 base score of 9.8, and the record does not list the issue in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13776 is a type confusion issue (CWE-843) in Dawn, as reported for Google Chrome before 150.0.7871.47. The record was published on 2026-06-30, and Chromium rates its security severity as Critical.

Impact

According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox by using a crafted HTML page. NVD assigns a CVSS 3.1 base score of 9.8. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a network-reachable, low-complexity attack that requires no privileges or user interaction, with high impact on confidentiality, integrity and availability. A second score of 9.6 from another provider also appears in the record, but that provider is not identified.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47.
  • The record does not list a fixed version. Because the affected range ends before 150.0.7871.47, that build is the first one the record treats as unaffected (inference).

Exploitation status

CVE-2026-13776 is not listed in the CISA KEV catalog in this record. No confirmed exploitation in the wild appears in the sources consulted. The FIRST EPSS probability is 0.00348 (percentile 0.26587), dated 2026-10-13. EPSS estimates the likelihood of exploitation but does not confirm it.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, and consult the vendor advisory listed in the references.
  • In managed environments, enforce browser update policies and confirm the deployed build on every endpoint.
  • Until updates are applied, reduce exposure to untrusted web content and keep browsers and their extensions current.

Detection guidance

  • Inventory Chrome versions across the environment and flag any build below 150.0.7871.47.
  • Review endpoint telemetry for unexpected browser crashes or unusual renderer behavior, recognizing that such signals are not specific to this issue.
  • Where available, use web filtering to monitor visits to suspicious sites that may serve crafted pages.

Limitations of the available information

  • The record gives no technical details about the flaw or its root cause.
  • The issue tracker entry is restricted to users with permissions, so its details were not reviewed.
  • The provider of the second CVSS score (9.6) is not identified.
  • The record does not establish how reliably the sandbox escape could be achieved.

Frequently asked questions

Which versions are affected?

According to the record, Google Chrome versions prior to 150.0.7871.47 are affected.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do?

Update Google Chrome to 150.0.7871.47 or later, then verify that every endpoint runs that build or newer.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.