CVE Intelligence
Analysis AI-assisted

CVE-2026-13789: Google Chrome GPU Use-After-Free with Possible Sandbox Escape

A use-after-free flaw in the GPU component of Google Chrome before 150.0.7871.47 could let a remote attacker who had already compromised the renderer attempt a sandbox escape through a crafted HTML page. The record rates the issue critical with CVSS 3.1 base score 9.6, while Chromium rates its security severity as High. No confirmed exploitation appears in the sources consulted, and the record shows no KEV listing.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13789 is a use-after-free weakness (CWE-416) in the GPU component of Google Chrome. According to the record, it becomes relevant when an attacker has already compromised the renderer process and then uses a crafted HTML page to attempt a sandbox escape. The described affected range is Chrome prior to 150.0.7871.47.

Impact

  • The record describes a potential sandbox escape, which would take an attacker beyond the browser's renderer isolation boundary.
  • The CVSS 3.1 base score is 9.6, with the vector shown in the record indicating network reachability, no privileges required, user interaction required, scope change and high impact to confidentiality, integrity and availability. This reading of the vector is an inference.
  • Chromium classifies the security severity as High.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47 is the range stated in the description.
  • The record's structured affected data also contains a second entry describing a version range from 150.0.7871.47 to 150.0.7871.47, which is internally contradictory. It should not be relied on without vendor confirmation.
  • The record has no populated fixed-version field. Treating 150.0.7871.47 as the first unaffected build is an inference drawn from the description.

Exploitation status

The record shows no KEV listing for this CVE, so it does not indicate active exploitation. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00345 (percentile 0.26182), and the SSVC fields list exploitation as none and automatable as no.

Remediation and mitigation

  • Update Google Chrome to 150.0.7871.47 or a later build on all desktop platforms, which is the standard remediation for this class of Chrome issue.
  • Fully restart the browser after the update so the new build is active, since a running session may keep the old code loaded.
  • Review the Chrome stable channel update note for the release that carries the fix.
  • Until patched, limit browsing of untrusted sites, especially on systems that handle sensitive data, and keep browser extensions to a minimum.

Detection guidance

  • Use endpoint management or software inventory to confirm the installed Chrome build across the fleet and flag any system below 150.0.7871.47.
  • Identify browsers that have not restarted since an update was staged, because they may still run the vulnerable build.
  • Review browser-related security telemetry for unusual renderer crashes or unexpected process behavior, understanding that this kind of signal is indirect and may not be conclusive.

Limitations of the available information

  • The record contains no fixed-version field, and the affected range is partly contradictory.
  • The Chromium issue tracker entry is marked as requiring permissions, so its technical details could not be verified from the record.
  • No proof-of-concept, technical write-up or threat intelligence is included, so the practical difficulty of a chained exploit is unknown.
  • Vendor advisories were not independently checked beyond the links in the record.

Frequently asked questions

Is CVE-2026-13789 being actively exploited?

The record does not show a KEV listing, and no confirmed exploitation in the wild appears in the sources consulted. The EPSS and SSVC values in the record also point to low current exploitation likelihood.

Which Chrome version fixes this issue?

The record does not include a fixed-version field. The description states the affected range as prior to 150.0.7871.47, so updating to 150.0.7871.47 or later is the expected remediation, though this is an inference.

What should administrators do right now?

Inventory Chrome builds, update systems to 150.0.7871.47 or later, restart the browser, and limit browsing of untrusted sites until patched.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.