CVE-2026-13920: Google Chrome Media Input Validation Flaw Enables Possible Sandbox Escape

Overview

CVE-2026-13920 is a flaw in the Media component of Google Chrome on Windows. The record describes insufficient validation of untrusted input that, combined with a prior compromise of the renderer process, could allow a sandbox escape when a crafted HTML page is processed. The issue is classified as CWE-20 (Improper Input Validation) in the record.

Impact

• The record describes a potential sandbox escape, which would extend an attacker's reach beyond the renderer process.
• The CVSS 3.1 vector assigns high impact to confidentiality, integrity and availability, with scope marked as changed and user interaction required.
• Exploitation depends on a prior renderer compromise, which the record does not further describe.
• Google's Chromium security severity for this issue is Medium, which differs from the critical label and 9.6 CVSS score in the record.

Affected products and versions

• Google Chrome on Windows, prior to 150.0.7871.47.
• The record's version list includes a second entry whose range starts and ends at 150.0.7871.47. This is internally inconsistent and should be treated as a data quality issue, not as a separate affected range.

Exploitation status

The record marks the vulnerability as not listed in the CISA Known Exploited Vulnerabilities catalog, and its SSVC exploitation value is none with automatable set to no. No confirmed active exploitation appears in the sources consulted.

Remediation and mitigation

• Update Google Chrome on Windows to version 150.0.7871.47 or later, which is the threshold stated in the description.
• The record contains no fixed-version field, so administrators should confirm the installed build against the Chrome stable channel release notes linked in the references.
• Fully relaunch the browser after updating so the new version is active.
• Organizations using managed update channels should confirm that the update has reached all Windows endpoints.

Detection guidance

• Inventory Chrome versions across Windows endpoints using existing asset management or endpoint tooling, and flag builds below the stated threshold.
• Review browser update deployment logs to confirm successful installation.
• Endpoint detection tools can help surface unusual browser process behavior, but the record provides no indicators of compromise or specific signatures.

Limitations of the available information

• The record does not describe the technical nature of the sandbox escape, and this analysis does not provide any.
• The record has no fixed-version field and a contradictory affected range entry.
• The EPSS date in the record (2026-10-13) is later than the publication date (2026-06-30); this should be verified against the source before relying on the EPSS values.
• The issue tracker reference is marked with a permissions-required tag, so its contents could not be verified.
• The contents of the stable channel release notes were not verified beyond the link being present in the record.

Frequently asked questions

Which Chrome versions are affected by CVE-2026-13920?

The record states that Google Chrome on Windows prior to 150.0.7871.47 is affected. A second entry in the version list is internally inconsistent and should not be read as an additional range.

Is CVE-2026-13920 known to be exploited in the wild?

The record shows it is not listed in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

What should administrators do first?

Update Chrome on Windows to version 150.0.7871.47 or later, confirm the installed build across endpoints, and fully restart the browser after the update.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.