CVE Intelligence
Analysis AI-assisted

CVE-2026-13797: Google Chrome Chromecast Input Validation Flaw Enables Possible Sandbox Escape

CVE-2026-13797 is an improper input validation flaw (CWE-20) in the Chromecast component of Google Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CNA rates it CVSS 3.1 9.6 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13797 is an insufficient input validation issue (CWE-20) in the Chromecast component of Google Chrome. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox by using a crafted HTML page. The Chromium security severity is rated High.

Impact

The record describes a potential sandbox escape. The CNA scores the issue at CVSS 3.1 base score 9.6 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The record does not describe consequences beyond the sandbox escape.

Affected products and versions

  • Google Chrome versions prior to 150.0.7871.47, as listed in the record.
  • The record lists no other products or platforms.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, following the vendor's stable channel update.
  • Verify installed versions on managed endpoints, especially systems where browser updates are deferred.
  • Keep automatic browser updates enabled.

Detection guidance

  • Inventory Chrome installations and compare reported versions against the 150.0.7871.47 threshold.
  • Treat unexpected browser crashes or renderer terminations as general signals to review, since they are not specific to this flaw.

Limitations of the available information

The record has no title and no entries in its fixes list. The issue tracker entry is tagged Permissions Required, so further technical details may be restricted. The record contains no technical exploitation details, and the EPSS probability is an estimate rather than evidence of exploitation.

Frequently asked questions

Is CVE-2026-13797 being exploited in the wild?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which Chrome version addresses this issue?

The record lists affected versions as those prior to 150.0.7871.47, so that version and later fall outside the stated range. Confirm against the vendor advisory before deployment.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.