CVE Intelligence
Analysis AI-assisted

CVE-2026-13869: Google Chrome Use-After-Free in Device Component on Windows Enables Sandbox Escape

A use-after-free flaw (CWE-416) in the Device component of Google Chrome on Windows is described as enabling a sandbox escape by an attacker who has already compromised the renderer process. The record lists versions prior to 150.0.7871.47 as affected and reports a CVSS 3.1 base score of 9.6. The sources consulted show no confirmed exploitation, and the CVE is not listed in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The CVE record describes a use-after-free weakness in the Device component of Google Chrome on Windows. According to the description, a remote attacker who had already compromised the renderer process could potentially perform a sandbox escape by using a crafted HTML page.

Impact

  • The record describes a potential sandbox escape after renderer compromise, which would extend the reach of an attacker beyond the browser's isolation boundary.
  • The CVSS 3.1 base score recorded by the CNA is 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. This indicates network delivery, user interaction required, scope change, and high impact to confidentiality, integrity and availability.
  • The vendor's own Chromium security severity label in the description is Medium, which differs from the CVSS score; both are reported as recorded.
  • The weakness is classified as CWE-416 (Use After Free).

Affected products and versions

  • Google Chrome on Windows, versions prior to 150.0.7871.47, according to the record.
  • The fixes field in the record is empty. The wording prior to 150.0.7871.47 suggests that build is the first unaffected release for this issue, which is an inference.

Exploitation status

The CVE is not listed in the CISA KEV catalog in this record, so active exploitation is not reported. No confirmed exploitation in the wild appears in the sources consulted. The EPSS record shows a probability of 0.00345 and a percentile of 0.26186 dated 2026-10-13.

Remediation and mitigation

  • Update Google Chrome on Windows to version 150.0.7871.47 or later, as described in the Chrome Releases stable channel update.
  • Prioritize updates on systems where users browse untrusted websites or open untrusted HTML content.
  • Confirm the installed build through the browser's version page or through endpoint management tooling.

Detection guidance

  • Inventory Chrome installations on Windows endpoints and flag any build below 150.0.7871.47.
  • Review browser crash telemetry and unexpected renderer or sandbox-related events as supporting signals, at a high level only.
  • Treat unexplained browser crashes after visits to untrusted pages as a reason to verify the installed version.

Limitations of the available information

  • The record contains only the short description and does not include technical root-cause detail.
  • The Chromium issue tracker link is tagged as requiring permissions, so further technical detail may not be publicly accessible.
  • The fixes list is empty and no explicit fixed-version field is populated.
  • The CVSS score comes from a single provider entry; no other scoring sources are listed.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-13869?

The record describes Google Chrome on Windows prior to 150.0.7871.47 as affected. Confirm your installed build against that version.

Is CVE-2026-13869 known to be actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. Keep monitoring official advisories.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.