CVE-2026-13796: Integer overflow in Chromecast in Google Chrome prior to 150

Synopsis

An integer overflow in the Chromecast component of Google Chrome before version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape the browser sandbox. The vulnerability is reachable over the network and requires the victim to visit a crafted HTML page, but no authentication is needed. Successful exploitation gives the attacker full control outside the sandbox, including high-impact reads, writes, and disruption of the host environment. A patched-image rebuild at 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the targeted Chrome instance must be reachable and the victim must navigate to an attacker-controlled page.

• AuthenticationNot required

  No account or credential of any kind is required; the attacker interacts anonymously with the victim's browser.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector where the attacker must lure or redirect the user.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special race conditions, memory-layout guessing, or other environmental prerequisites beyond the renderer compromise assumed in the description.

Blast Radius

• Reads sensitive data accessible to the Chrome process outside the sandbox, including stored credentials, session tokens, and local files.
• Writes or modifies data on the host filesystem and any resources the compromised process can reach.
• Crashes or disrupts the affected Chrome instance and any associated services on the host.
• Breaks out of the browser sandbox entirely, giving the attacker a foothold in the broader host environment with Chrome-level OS privileges.