CVE Intelligence
Analysis AI-assisted

CVE-2026-13781: Google Chrome Skia Improper Input Validation Enabling Sandbox Escape

Google Chrome's Skia graphics library does not sufficiently validate untrusted input (CWE-20). According to the record, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. NVD lists a CVSS 3.1 base score of 9.6, and the CVE is not listed in CISA KEV in the sources consulted, so the main defensive step is updating Chrome to the version named in the description.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This record describes an insufficient input validation weakness (CWE-20) in Skia, the 2D graphics library used by Google Chrome. The description states that the flaw could let a remote attacker who had already compromised the renderer process potentially escape the browser sandbox through a crafted HTML page. The record was published on 2026-06-30 and is marked as Modified in the source data.

Impact

The NVD base score is 9.6 under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. That vector indicates network attack vector, low complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity and availability. A sandbox escape means code running in the renderer could reach resources outside the sandbox, which is why the Chromium security severity is rated Critical.

Affected products and versions

  • Product: Google Chrome (desktop)
  • Description wording: prior to 150.0.7871.47
  • Structured affected range in the record: less than 150.0.7871.46

The two version boundaries differ by one build number. Administrators should treat any Chrome build below 150.0.7871.47 as potentially affected until the vendor clarifies the range. The vendor release notes are listed in the references: Chrome stable channel update.

Exploitation status

The CISA KEV catalog does not list this CVE in the sources consulted, so no active exploitation is confirmed by this record. No confirmed exploitation appears in the sources consulted. The FIRST EPSS estimate is a probability of 0.00425 with a percentile of 0.34991, dated 2026-10-13, which is a statistical prediction and not evidence of exploitation.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later on all desktop platforms, which is the boundary stated in the description.
  • Prioritize the update for users who browse untrusted web content, since the attack path involves a crafted HTML page.
  • Verify that managed browsers receive the update through the organization's endpoint management tooling.
  • Confirm that auto-update is enabled and that restarts are completed, because a running browser can continue using the old build until it is relaunched.

Detection guidance

  • Inventory Chrome versions across endpoints and flag any build below 150.0.7871.47.
  • Review browser update logs and endpoint management reports for failed or pending updates.
  • Monitor for unexpected child processes or privilege changes originating from browser processes, as a general indicator of sandbox-related abuse, while recognizing that this is a high-level signal and not a specific signature for this flaw.

Limitations of the available information

  • The structured affected range (less than 150.0.7871.46) differs from the boundary in the description (150.0.7871.47). The discrepancy is not explained in the record.
  • The structured fixes list is empty. The absence of a listed fix does not mean no fix exists; the vendor release note is the referenced source for the patched build.
  • The Chromium issue tracker entry is marked as requiring permissions, so its technical details could not be verified from the record.
  • No public proof-of-concept or exploit details are included in the record, and none are provided here.

Frequently asked questions

Which Chrome version addresses CVE-2026-13781?

The description states the flaw affects versions prior to 150.0.7871.47, so builds 150.0.7871.47 or later are the boundary to target. The structured record lists a different range (less than 150.0.7871.46), so verify against the vendor release notes.

Is CVE-2026-13781 known to be exploited in the wild?

The CVE is not listed in CISA KEV in the sources consulted, and no confirmed exploitation appears in those sources. The EPSS score is a statistical estimate, not evidence of exploitation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.