CVE-2026-13846: Use after free in USB in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability in the USB handling code of Google Chrome on macOS affects all Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but does require a victim to load a crafted HTML page in a browser where the renderer process has already been compromised. Successful exploitation allows a remote attacker to escape Chrome's sandbox, giving them access to the host operating system beyond the browser's normal isolation boundary. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted host must be reachable through a browser session exposed to attacker-controlled web content.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any anonymous visitor to the malicious page is a viable target.

• Victim interactionRequired

  The victim must load a crafted HTML page in the browser, requiring the attacker to social-engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors, though it does assume the renderer process is already compromised as a prerequisite.

Blast Radius

• A successful attacker escapes Chrome's sandbox and gains code execution in the context of the host macOS user account running the browser.
• Confidential data accessible to that user account, including files, keychain secrets, and session tokens stored on disk, becomes readable to the attacker.
• The attacker can write or modify files on the host filesystem within the permissions of the compromised user, enabling persistence mechanisms or data tampering.
• The attacker can crash or disrupt the browser process and any dependent services running under the same user context.