CVE Intelligence
Analysis AI-assisted

CVE-2026-13901: Google Chrome Serial Component Sandbox Escape via Insufficient Policy Enforcement

CVE-2026-13901 affects Google Chrome versions prior to 150.0.7871.47. The record describes insufficient policy enforcement in the Serial component that could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox through a crafted HTML page. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13901 affects Google Chrome prior to 150.0.7871.47. According to the record, insufficient policy enforcement in the Serial component could let a remote attacker who had already compromised the renderer process potentially escape the sandbox via a crafted HTML page. The Chromium security severity is rated Medium, while the CVSS 3.1 base score recorded by the CNA and CISA ADP is 9.6.

Impact

  • The record describes a sandbox escape, which would extend an attacker's reach beyond the renderer process.
  • The recorded CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) denotes network attack vector, no privileges required, user interaction required, scope change, and high impact to confidentiality, integrity and availability.
  • The record presents the sandbox escape as dependent on a prior renderer compromise, so it should be assessed as part of a chain rather than as a standalone issue.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47, as stated in the description.
  • The affected field contains two entries: one for versions below 150.0.7871.47 and one range that begins and ends at 150.0.7871.47. The second entry is internally inconsistent and should be checked against the vendor release notes.
  • The record contains no populated fixes list.

Exploitation status

This CVE is not listed in the CISA KEV catalog in the record. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation value is none and automatable is no. The EPSS probability is 0.00345 with a percentile of 0.26194, dated 2026-10-13.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, consistent with the boundary stated in the description.
  • Confirm update status on managed fleets through enterprise update channels and verify installed build numbers.
  • Review the vendor release notes linked in the references for the full list of fixes in the same update.

Detection guidance

  • Inventory Chrome build versions across endpoints and flag installations below 150.0.7871.47.
  • Review endpoint telemetry for unexpected renderer process crashes or anomalous child process activity originating from the browser, as a high-level indicator of compromise attempts.

Limitations of the available information

  • The record does not provide technical details about the specific policy check or the Serial feature path involved.
  • The title field was empty in the record and the affected ranges are inconsistent.
  • No fixes are listed in the record, so the fixed version is taken from the description's wording only.
  • The CVSS base score is recorded as 9.6 by two providers, while the Chromium severity is Medium; the difference reflects different scoring frameworks.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-13901?

The record describes Google Chrome versions prior to 150.0.7871.47 as affected. The affected field also contains an inconsistent second range, so the vendor release notes should be checked.

Is CVE-2026-13901 known to be actively exploited?

No. The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Update Google Chrome to 150.0.7871.47 or later and verify installed builds across managed endpoints.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.