CVE-2026-13782: Use after free in Browser in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in Google Chrome's browser process (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The attack is reachable over the network and requires the victim to visit a malicious or attacker-controlled page, but no authentication is needed. Successful exploitation gives the attacker full code execution outside the sandbox, enabling read and write access to the host system and the ability to crash or disrupt the browser entirely. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote host, meaning the Chrome browser must be able to make outbound connections to attacker-controlled infrastructure.

• AuthenticationNot required

  No account, credential, or prior session is needed; any unauthenticated remote party can deliver the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering vector requiring at least one user action such as clicking a link.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special race-condition, memory-layout, or environmental precondition beyond the renderer compromise that is the stated starting point.

Blast Radius

• Attacker escapes the Chrome sandbox and executes arbitrary code in the context of the browser process on the host operating system.
• With sandbox escape achieved, the attacker reads files, stored credentials, cookies, and session tokens accessible to the browser process user.
• The attacker writes or modifies files on the host, installs persistent payloads, or alters browser profile data.
• The browser process can be crashed or terminated, disrupting service for the affected user session.