CVE Intelligence
Analysis AI-assisted

CVE-2026-13859: Google Chrome ANGLE Inappropriate Implementation Enabling Possible Sandbox Escape

CVE-2026-13859 affects Google Chrome versions before 150.0.7871.47 and stems from an inappropriate implementation in the ANGLE graphics component. A remote attacker could potentially escape the browser sandbox using a crafted HTML page. The record lists a CVSS 3.1 base score of 9.6 (critical) and Chromium security severity Medium, with no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an inappropriate implementation in ANGLE, a graphics abstraction layer used by Google Chrome, classified as CWE-693 (protection mechanism failure). According to the record, a remote attacker could potentially use a crafted HTML page to escape the browser sandbox. The issue is referenced in the Chrome stable channel update and in the Chromium issue tracker.

Impact

  • A successful sandbox escape would move an attacker beyond the browser isolation boundary. The record describes this as a potential outcome, not a demonstrated one.
  • The CVSS 3.1 vector lists network attack vector, low complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity and availability, with a base score of 9.6.
  • Chromium rates the security severity as Medium, which uses a different scale from the CVSS score.

Affected products and versions

  • Google Chrome versions before 150.0.7871.47 are described as affected.
  • The affected range in the record is internally inconsistent. One entry reads below 150.0.7871.46, and a second entry reads at or above 150.0.7871.47 and below 150.0.7871.47, which matches no version. Confirm the exact range against the vendor advisory.

Exploitation status

  • The record does not list this CVE in CISA KEV. No confirmed exploitation appears in the sources consulted.
  • The SSVC fields in the record show exploitation as none and automatable as no. The EPSS probability is 0.00379, approximately 0.38 percent.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later on all affected desktop platforms, following the vendor advisory.
  • Prioritize the update on systems used to browse untrusted content, since the described attack path depends on a crafted HTML page.
  • Keep automatic browser updates enabled and verify the installed version after patching.
  • In high-risk environments, limit browsing to trusted sites until the update is deployed.

Detection guidance

  • Inventory Chrome versions across endpoints and flag installations below 150.0.7871.47.
  • Monitor browser crash reports and unusual behavior of browser processes at a general level. The record provides no specific indicators of compromise.

Limitations of the available information

  • The record contains no fix entries, no CWE name, and no technical details beyond the short description.
  • The affected version range is contradictory, as noted above.
  • The record does not state whether public proof-of-concept code exists.
  • The sources consulted do not confirm real-world exploitation.

Frequently asked questions

What is CVE-2026-13859?

It is a vulnerability in the ANGLE component of Google Chrome, described as an inappropriate implementation that could let a remote attacker potentially escape the browser sandbox through a crafted HTML page.

Which Chrome versions are affected?

The record describes Chrome versions before 150.0.7871.47 as affected, but its affected range is internally inconsistent, so the vendor advisory should be checked for the exact range.

Is this vulnerability being exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.