CVE Intelligence
Analysis AI-assisted

CVE-2026-13880: Google Chrome for macOS: use-after-free in USB component

CVE-2026-13880 is a use-after-free flaw in the USB component of Google Chrome on Mac. A remote attacker who has already compromised the renderer process could potentially use a crafted HTML page to attempt a sandbox escape. The CNA and CISA-ADP score it 9.6 (Critical) under CVSS 3.1, while Chromium lists its internal severity as Medium, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13880 is a use-after-free weakness (CWE-416) in the USB component of Google Chrome on Mac. The record states that it affects Chrome versions prior to 150.0.7871.47. The vulnerability class is memory safety, and the stated consequence is a possible sandbox escape after the renderer process has already been compromised.

Impact

  • The description says a remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
  • The CNA and CISA-ADP both list a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • The vector includes user interaction (UI:R) and a scope change (S:C), which the scoring reflects.
  • The Chromium security severity is Medium, which differs from the critical rating given under CVSS. Both values are reported as they appear in the record.

Affected products and versions

  • Google Chrome on Mac, prior to 150.0.7871.47, according to the record's description.
  • The affected-version data contains a second entry, "≥ 150.0.7871.47 and < 150.0.7871.47", which is contradictory because the range is empty. It should not be read as a confirmed range.
  • The record names only Mac. It does not state whether Chrome on Windows, Linux or ChromeOS is affected.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted. The SSVC fields in the record give exploitation as none and automatable as no.
  • The EPSS probability is 0.00306 with a percentile of 0.21656, as recorded.

Remediation and mitigation

  • Update Google Chrome on macOS to version 150.0.7871.47 or later. The record places the affected range below that version, so this is the version to target. Confirm the exact fixed build in the vendor advisory.
  • Use the browser's automatic update mechanism, or the organization's endpoint management tooling, to deploy the stable channel update.
  • Where updates cannot be applied immediately, reduce exposure by limiting browsing of untrusted sites on managed Mac devices and by monitoring for unusual browser behavior. Treat this as a temporary measure only.

Detection guidance

  • Inventory Google Chrome versions on Mac endpoints and flag any build earlier than 150.0.7871.47.
  • Use fleet or MDM reporting to confirm that the update has reached all managed devices and to track devices that remain outdated.
  • Watch for unexpected child processes or privilege changes associated with the browser, as a general high-level indicator of sandbox-related abuse. No specific indicator of compromise is provided in the record.

Limitations of the available information

  • The record has no title, so the title in this analysis was written for the portal.
  • The Chromium issue tracker entry is marked as requiring permissions, so technical details beyond the description are not available here.
  • The record has no explicit fixed-version field. The fixed version is inferred from the description's "prior to 150.0.7871.47" wording.
  • The affected range contains a contradictory entry.
  • The EPSS date in the record is later than the publication date, so the EPSS values should be treated with caution.

Frequently asked questions

What is CVE-2026-13880?

It is a use-after-free flaw in the USB component of Google Chrome on Mac, prior to version 150.0.7871.47. The record says it could allow a sandbox escape by a remote attacker who had already compromised the renderer process.

Is this vulnerability being actively exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which version should I update to?

The record places affected versions below 150.0.7871.47, so updating to that version or later is the expected remediation. Confirm the exact build in the vendor advisory.

Why do the severity ratings differ?

The CNA and CISA-ADP give a CVSS 3.1 score of 9.6, while Chromium lists its internal security severity as Medium. Both are reported as they appear in the record.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.