CVE-2026-13783: Use after free in Views in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability exists in the Views component of Google Chrome prior to version 150.0.7871.47. The flaw is reachable over the network and requires no authentication, though a victim must be persuaded to perform specific UI gestures on a crafted HTML page. Successful exploitation corrupts heap memory and gives the attacker full read, write, and crash capabilities in the browser process, enabling data theft, content tampering, and denial of service. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled content on the internet or local network.

• AuthenticationNot required

  No account, session, or credential of any kind is required; the attack is launched through an ordinary unauthenticated web page.

• Victim interactionRequired

  The attacker must convince the victim to visit the crafted page and perform specific UI gestures, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker gains the ability to read browser memory contents, including stored session tokens, saved credentials, and page data from other origins.
• The attacker can write to heap memory, allowing modification of in-flight web content or browser state.
• The heap corruption can be leveraged to crash the Chrome renderer or browser process, causing a denial of service for the affected user.
• Because the CVSS scope is Changed, the exploit can break out of the renderer sandbox and affect resources beyond the originating browser context.