CVE-2026-13792: Use after free in Touchbar in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability in the Touchbar component of Google Chrome on macOS affects all Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network without any authentication, but requires a user to visit a specially crafted HTML page. Successful exploitation allows a remote attacker to escape the browser sandbox and gain the ability to read sensitive data, modify files, and crash or take control of the affected system. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the target to a crafted HTML page, so the Chrome instance must be reachable via normal web browsing.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the target to load a URL.

• Victim interactionRequired

  The user must visit an attacker-controlled or compromised web page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites beyond the victim loading the page.

Blast Radius

• Attacker escapes the Chrome renderer sandbox and gains code execution in the browser process, breaking the primary isolation boundary between web content and the host OS.
• Confidential data accessible to the browser (stored credentials, session cookies, locally cached files) becomes readable to the attacker.
• The attacker can write or modify files on the host filesystem with the permissions of the Chrome process user.
• The affected Chrome process can be crashed or hijacked, disrupting the user's session and any dependent services.