CVE-2026-13798: Heap buffer overflow in Chromecast in Google Chrome prior to 150

Synopsis

A heap buffer overflow vulnerability exists in the Chromecast component of Google Chrome prior to version 150.0.7871.47. The flaw is reachable over the network and requires no prior authentication, though a victim must interact with a crafted HTML page, and the attacker must already have compromised the Chrome renderer process. Successful exploitation enables a sandbox escape, giving the attacker full read, write, and denial-of-service capability on the underlying system. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted Chrome instance must be reachable or the victim must browse to an attacker-controlled resource across the internet.

• AuthenticationNot required

  No account credentials or session tokens are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must open or be directed to a crafted HTML page, making this a social-engineering or drive-by scenario where user action triggers the overflow.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and imposes no special race-condition or memory-layout preconditions beyond the attacker already controlling the renderer process.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code outside the Chrome sandbox with the privileges of the browser process.
• The attacker gains full read access to files, credentials, and session data accessible by the browser process on the host.
• The attacker can write or modify data on the host filesystem within the browser process scope, including cached credentials and stored profiles.
• The attacker can crash or destabilize the browser process, causing a denial of service for the affected user session.