CVE Intelligence
Analysis AI-assisted

CVE-2026-13883: Type Confusion in ANGLE in Google Chrome

CVE-2026-13883 is a type confusion flaw in the ANGLE graphics component of Google Chrome, reported as allowing a remote attacker to potentially escape the sandbox through a crafted HTML page. The record assigns a CVSS 3.1 base score of 9.6 (critical) and states that Chromium rates the issue as Medium security severity. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13883 describes a type confusion weakness (CWE-843) in ANGLE, the graphics translation layer used by Google Chrome. According to the record, the flaw can be triggered through a crafted HTML page and could potentially let an attacker escape the browser sandbox. The Chromium project rates its security severity as Medium, while the NVD-style CVSS record used here scores it as critical.

Impact

The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. This indicates a network attack that needs no privileges but requires user interaction, such as a victim opening a malicious page. It also indicates a changed scope and high impact on confidentiality, integrity and availability. A sandbox escape would mean code running inside the renderer could affect resources beyond the browser's isolation boundary.

Affected products and versions

  • Product: Google Chrome
  • Affected range in the record: less than 150.0.7871.46
  • Description text in the record: prior to 150.0.7871.47

The two version strings differ. The affected-range field and the description do not match exactly, so administrators should confirm the boundary against the vendor advisory before relying on it.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record. No confirmed active exploitation or exploitation in the wild appears in the sources consulted for this analysis. This statement reflects the available data only and may change as new information is published.

Remediation and mitigation

  • Update Google Chrome to a version newer than the affected range stated in the record. The record references a Chrome stable channel update from June 2026 as a vendor advisory.
  • Verify the installed version on all managed endpoints, including systems that run Chromium-based browsers that may consume the same component, if your inventory includes them.
  • Keep automatic browser updates enabled and prioritize browsers used to access untrusted web content.
  • Restrict browsing of untrusted sites on sensitive hosts until the update is applied.

The record contains no fixed version field, but the absence of that field does not mean that no fix exists.

Detection guidance

  • Maintain an inventory of Chrome versions across the organization and flag hosts below the threshold confirmed in the vendor advisory.
  • Review endpoint telemetry for unexpected renderer process crashes or unusual child processes spawned by the browser, as general indicators of browser compromise.
  • Monitor for browser versions that fail to update, since unpatched hosts are the main exposure.

Limitations of the available information

The Chromium issue tracker entry is tagged as requiring permissions, so the technical details of the bug could not be reviewed. The record does not include a fixed version field, a vendor-confirmed list of fixed builds, or a confirmed proof of concept. The EPSS values present in the record could not be independently verified against the FIRST source in this analysis, and the EPSS date recorded is later than the publication date.

Frequently asked questions

Is CVE-2026-13883 being actively exploited?

The record shows that this CVE is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted for this analysis.

Which Chrome versions are affected?

The record gives the affected range as less than 150.0.7871.46, while its description says prior to 150.0.7871.47. The two values differ, so check the vendor advisory to confirm the exact boundary.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.