CVE Intelligence
Analysis AI-assisted

CVE-2026-13861: Google Chrome use-after-free in Core enabling possible sandbox escape (CWE-416)

CVE-2026-13861 is a use-after-free (CWE-416) in the Core component of Google Chrome. According to the description, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CVSS 3.1 base score of 9.6 is provided by the CNA and CISA-ADP, and the record shows no KEV listing or confirmed exploitation in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes a use-after-free (CWE-416) in the Core component of Google Chrome. According to the description, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page.

Impact

  • The described outcome is a potential sandbox escape after renderer compromise.
  • The CVSS 3.1 base score of 9.6 is listed by the CNA and by CISA-ADP, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • That vector indicates high impact to confidentiality, integrity and availability, with user interaction required and a scope change.
  • The Chromium security severity label is Medium, while the CVSS score is 9.6. These come from different scoring methods and should be read in context.

Affected products and versions

  • Product listed: Google Chrome.
  • The description states that versions prior to 150.0.7871.47 are affected.
  • The affected range in the record is inconsistent: one entry covers versions below 150.0.7871.46, and a second entry is an empty range at 150.0.7871.47.
  • The record contains no fixed-version entries.

Exploitation status

  • The record shows the KEV listing as false. No confirmed exploitation in the wild appears in the sources consulted.
  • The SSVC fields list exploitation as none and automatable as no.
  • EPSS is 0.00306 with a percentile of 0.21656, dated 2026-10-13.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, since the description places the vulnerable range below that build.
  • Confirm the exact fixed build and platform details in the vendor advisory before rollout.
  • Keep browser auto-update enabled where possible, and avoid leaving managed devices on older builds.

Detection guidance

  • Inventory Chrome installations and record their build numbers to identify systems below the boundary version.
  • Use software asset management or endpoint management reports to find Chrome builds that have not been updated.
  • Watch for unexpected renderer crashes or abnormal browser behavior as general signals. These are not specific to this flaw.

Limitations of the available information

  • The record has no original English title, so the titles here are derived from the description.
  • The fixes list is empty and the affected range is ambiguous.
  • The record includes no exploit details, and this analysis does not provide any.
  • The Chromium issue tracker entry is tagged as requiring permissions, so its contents are not reflected here.

Frequently asked questions

What is CVE-2026-13861?

It is a use-after-free vulnerability (CWE-416) in the Core component of Google Chrome. The description says it could allow a sandbox escape after a renderer compromise.

Which versions are affected?

The description states that versions prior to 150.0.7871.47 are affected. The affected range in the record is ambiguous, so the vendor advisory should be checked for exact boundaries.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.