CVE-2026-13784: Use after free in Views in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability exists in the Views component of Google Chrome prior to version 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but an attacker must convince a victim to perform specific UI gestures on a crafted HTML page; successful exploitation causes heap corruption that gives the attacker high-confidence read and write access to process memory and can crash the browser, enabling remote code execution. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be able to reach attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; any user who visits the malicious page is a viable target.

• Victim interactionRequired

  The attacker must socially engineer the victim into performing specific UI gestures (such as clicks or drags) on the crafted page to trigger the use-after-free condition.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layouts, or other unpredictable environmental factors once the victim completes the required gestures.

Blast Radius

• Reads arbitrary process memory, exposing session tokens, saved credentials, and page content from the compromised renderer.
• Writes to freed heap memory, enabling an attacker to corrupt browser internals and achieve remote code execution in the renderer process.
• With the Changed scope (S:C) flag in the CVSS vector, impact can break out of the renderer sandbox and affect the host browser process or other browser components.
• Crashes the affected Chrome instance, causing a denial of service for the user.