CVE-2026-13789: Use after free in GPU in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in the GPU component of Google Chrome (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox via a crafted HTML page. The attack is initiated over the network and requires the victim to visit or interact with a malicious page, but no authentication is needed. Successful exploitation gives the attacker full read, write, and execution capability outside the browser sandbox, effectively compromising the underlying host. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the target Chrome instance must be reachable in the sense that the victim's browser fetches attacker-controlled content from a remote origin.

• AuthenticationNot required

  No account or credential is required; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit or otherwise load the attacker's crafted HTML page, making this a social-engineering or drive-by-download scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions beyond the renderer compromise already assumed by the vulnerability.

Blast Radius

• An attacker who escapes the sandbox gains code execution in the context of the browser process, outside Chrome's isolation boundary, with access to the host OS.
• Confidentiality impact is High: the attacker can read files, credentials, session tokens, and other data accessible to the user running Chrome.
• Integrity impact is High: the attacker can write to the filesystem, modify persisted application data, or install persistent malware.
• Availability impact is High: the attacker can crash or terminate processes, corrupt data, or render the affected system unusable.