CVE Intelligence
Analysis AI-assisted

CVE-2026-13909: Google Chrome DevTools Sandbox Escape via Insufficient Policy Enforcement

CVE-2026-13909 affects Google Chrome versions prior to 150.0.7871.47 and involves insufficient policy enforcement in DevTools. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Google Chrome versions prior to 150.0.7871.47 contain an insufficient policy enforcement issue in DevTools, classified under CWE-693. According to the record, a remote attacker who had already compromised the renderer process could potentially escape the sandbox through a crafted HTML page. The record lists the Chromium security severity as Medium.

Impact

  • The record describes a potential sandbox escape, which would extend an attacker's reach beyond the renderer process.
  • The record provides a CVSS 3.1 base score of 9.6 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network attack vector, user interaction required, scope change and high impact on confidentiality, integrity and availability.
  • The Chromium severity label (Medium) and the CVSS score in the record are different measures; the sources consulted do not explain the difference.

Affected products and versions

  • Google Chrome prior to 150.0.7871.47, as listed in the record.
  • The record does not list other products, platforms or builds.

Exploitation status

  • The record shows no CISA KEV listing (kev.listed is false). No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome to version 150.0.7871.47 or later, which follows from the affected range in the record. Check the vendor release notes for the build applicable to each platform.
  • Keep automatic updates enabled and verify the installed version on managed endpoints.
  • Until patched, limit browsing of untrusted websites on sensitive systems and restrict DevTools use where operationally feasible. This is an inference from the nature of the issue, not a vendor recommendation.

Detection guidance

  • Inventory Chrome installations and compare each installed build against 150.0.7871.47.
  • Review endpoint logs for unexpected Chrome process activity after visits to untrusted pages. This is a general recommendation and not a detection signature from the sources.

Limitations of the available information

  • The record contains no entries in its fixes field, so the fixed build is inferred only from the affected range.
  • No technical details beyond the description, the Chromium issue tracker entry and the vendor release notes are available.
  • The EPSS values in the record estimate exploitation likelihood and do not confirm exploitation.
  • The CWE name is not provided in the record.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-13909?

The record lists Google Chrome versions prior to 150.0.7871.47 as affected. Updating to 150.0.7871.47 or later addresses the affected range shown in the record.

Is CVE-2026-13909 known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.