CVE Intelligence
Analysis AI-assisted

CVE-2026-13780: Google Chrome ANGLE Insufficient Input Validation Enabling Sandbox Escape

CVE-2026-13780 is an insufficient input validation issue in ANGLE, the graphics component of Google Chrome, affecting builds prior to 150.0.7871.47. The record describes a sandbox escape that requires an attacker who has already compromised the renderer process and a crafted HTML page. The NVD and CISA-ADP scores are 9.6 (CVSS 3.1), but no confirmed exploitation appears in the consulted sources.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13780 is classified as CWE-20 (Improper Input Validation). According to the description, ANGLE, the graphics translation layer used by Google Chrome, does not sufficiently validate untrusted input. A remote attacker who has already compromised the renderer process could potentially use a crafted HTML page to escape the sandbox. Google rates the issue as Critical in its Chromium security severity classification.

Impact

The record states that a successful sandbox escape is possible, which would move an attacker beyond the restricted renderer environment. The NVD and CISA-ADP vectors (CVSS 3.1, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) indicate network reachability, low complexity, user interaction required, scope change, and high confidentiality, integrity and availability impact. The exploit chain described requires a renderer compromise first, which is a separate precondition.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47, as stated in the description.
  • The structured affected data lists the range below 150.0.7871.46 and a second entry, 150.0.7871.47 and less than 150.0.7871.47, which is internally inconsistent and should not be relied on alone.
  • No fixed-version field is populated in the record. The description implies that 150.0.7871.47 contains the correction.

Exploitation status

The KEV catalog does not list this CVE, so no active exploitation is confirmed by CISA. The SSVC data in the record reports exploitation as none and automatable as no. The EPSS probability is 0.00425 (percentile 0.34991), dated 2026-10-13. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to 150.0.7871.47 or later, consistent with the vendor advisory.
  • Verify update status across managed browsers and Chromium-based deployments that embed ANGLE, since downstream products may ship the fix on their own schedules.
  • Keep automatic updates enabled and prioritize browsers used to open untrusted content.

Detection guidance

  • Inventory Chrome versions across endpoints and flag any build older than 150.0.7871.47.
  • Monitor for unexpected renderer process crashes or abnormal child process behavior as a general defensive signal, without treating it as proof of compromise.
  • Review endpoint telemetry for anomalies following browsing of untrusted or unfamiliar web content on unpatched systems.

Limitations of the available information

The record does not include a fixed-version field, a detailed technical write-up, or public proof-of-concept information. The affected version ranges are contradictory in their structured form. Vendor bug tracker access may be restricted. The CVSS vector and the Chromium severity label come from the record and were not independently verified.

Frequently asked questions

Is CVE-2026-13780 being actively exploited?

The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The SSVC exploitation value in the record is none.

Which Chrome version fixes CVE-2026-13780?

The description states that versions prior to 150.0.7871.47 are affected, which implies 150.0.7871.47 contains the correction. The structured record does not include a dedicated fixed-version field, so the vendor advisory should be checked.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.