CVE Intelligence
Analysis AI-assisted

CVE-2026-13882: Google Chrome USB Race Condition Enabling Possible Sandbox Escape

CVE-2026-13882 is a race condition (CWE-362) in the USB component of Google Chrome prior to 150.0.7871.47. According to the record, a remote attacker who has already compromised the renderer process could potentially escape the sandbox using a crafted HTML page. The CNA and CISA-ADP report a CVSS 3.1 base score of 9.6, while the Chromium project rates the issue as Medium severity.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13882 is a race condition (CWE-362) in the USB component of Google Chrome, published on 2026-06-30. The record describes a remote attacker who has already compromised the renderer process and could potentially use a crafted HTML page to escape the browser sandbox. The Chromium project classifies its security severity as Medium.

Impact

  • The record describes a potential sandbox escape, which would take an attacker beyond the restricted environment of the renderer process.
  • The CNA and CISA-ADP both report a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, which reflects high confidentiality, integrity and availability impact with a scope change.
  • The vector and description both imply that a renderer compromise must already exist and that user interaction is required.

The CVSS score is a standardized estimate and does not replace a local risk assessment.

Affected products and versions

  • The description identifies Google Chrome prior to 150.0.7871.47 as affected.
  • The structured affected field lists a range below 150.0.7871.46 and a second range that is internally inconsistent, so the exact boundary should be confirmed in the Chrome Releases advisory.
  • The fixes field in the record is empty. The version 150.0.7871.47 mentioned in the description is the only fixed-version indicator available.

Exploitation status

The record lists this CVE as not present in the CISA KEV catalog, and the SSVC exploitation value is none. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00244, with a percentile of 0.14465.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, following the Chrome Releases advisory.
  • Confirm that managed fleets receive the update and that browsers are restarted after installation.
  • Keep automatic updates enabled and limit browsing of untrusted sites on sensitive systems where operationally feasible.

Detection guidance

  • Inventory Chrome versions across endpoints and flag any installation below 150.0.7871.47.
  • Review endpoint and browser telemetry for unexpected renderer crashes or unusual sandbox process behavior. Treat these as signals to investigate, not as confirmation of compromise.

Limitations of the available information

  • The record does not include technical details of the race condition, the affected USB code path, or any validation data, and this analysis does not add them.
  • The issue tracker entry is marked as requiring permissions, so its contents could not be relied upon.
  • The affected version range is internally inconsistent and the fixes field is empty.
  • The EPSS date of 2026-10-13 is later than the publication date. The value is reported as recorded.

Frequently asked questions

What is CVE-2026-13882?

It is a race condition in the USB component of Google Chrome prior to 150.0.7871.47. The record says a remote attacker who already compromised the renderer process could potentially escape the sandbox through a crafted HTML page.

What should administrators do?

Update Google Chrome to 150.0.7871.47 or later, confirm that managed devices receive the update and restart browsers afterward. Inventory versions to find installations that remain outdated.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.