CVE-2026-13853: Use after free in Journeys in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in the Journeys feature of Google Chrome prior to version 150.0.7871.47 allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires the victim to visit a malicious page, but no authentication is needed. Successful exploitation gives the attacker full control outside the sandbox, enabling arbitrary code execution, data theft, and system compromise. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated remote attacker can attempt exploitation.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page, making social engineering or a malicious link the primary delivery vector.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors beyond having a compromised renderer process.

Blast Radius

• The attacker escapes the Chrome browser sandbox and gains code execution in the context of the host process.
• Confidential data accessible to the browser or host user account, including stored credentials, cookies, and local files, is readable by the attacker.
• The attacker can write or modify files and system state on the host, enabling persistence mechanisms or further lateral movement.
• The affected Chrome process and dependent services can be crashed or made unavailable.