CVE Intelligence
Analysis AI-assisted

CVE-2026-13782: Google Chrome Browser Use-After-Free Enabling Sandbox Escape

CVE-2026-13782 is a use-after-free in the Browser component of Google Chrome, classified as CWE-416. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The description states the issue is fixed in Chrome 150.0.7871.47, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13782 describes a use-after-free (CWE-416) in the Browser component of Google Chrome. The record was published on 2026-06-30 by the Chrome CNA. The description says a remote attacker who had already compromised the renderer process could potentially perform a sandbox escape using a crafted HTML page. Chromium rates the issue Critical.

Impact

  • NVD assigns a base score of 10.0 under CVSS 3.1, with network attack vector, low complexity, no privileges required, no user interaction, changed scope, and high confidentiality, integrity and availability impact.
  • Other providers in the record list 9.6 under CVSS 3.1.
  • The stated impact is a sandbox escape that would follow a renderer compromise, so the practical risk depends on whether a renderer compromise is achievable.

Affected products and versions

  • Product: Google Chrome.
  • The description places the issue in versions prior to 150.0.7871.47.
  • The structured affected list contains an entry for versions below 150.0.7871.46 and a second entry whose range is internally inconsistent. The fixes list in the record is empty.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record.
  • The SSVC fields report exploitation as none and automatable as no.
  • The EPSS probability is 0.00319 with a percentile of 0.23123.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, as indicated by the description and the Chrome stable channel update cited in the references.
  • Prioritize updates on systems where Chrome is used to browse untrusted content.
  • Confirm that managed browser fleets receive the update, since the record does not describe any workaround.

Detection guidance

  • Inventory installed Chrome versions through endpoint management tooling and flag installations below 150.0.7871.47.
  • Review browser update logs to confirm successful deployment.
  • Monitor for unexpected child processes or renderer crashes on endpoints as general defensive signals, without relying on this as a reliable indicator.

Limitations of the available information

  • The record does not include a fixes list, so the fixed version is taken from the description only.
  • The affected version ranges are inconsistent in the structured data.
  • Scores differ between providers, and the EPSS date is later than the publication date.
  • The linked Chromium issue tracker entry requires permissions, so further technical detail was not available.
  • The record has no English title, which was written for this analysis.

Frequently asked questions

Is CVE-2026-13782 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Chrome version fixes this issue?

The description indicates that versions prior to 150.0.7871.47 are affected, so updating to 150.0.7871.47 or later is the recommended remediation.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.