CVE-2026-13854: Use after free in Ozone in Google Chrome on Linux prior to 150

Synopsis

A use-after-free vulnerability exists in the Ozone display subsystem of Google Chrome on Linux, affecting all versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, though a victim must visit a crafted HTML page; an attacker who has already compromised the renderer process can trigger the bug to escape the Chrome sandbox. Successful exploitation grants the attacker full read, write, and execution capabilities outside the sandbox, effectively giving them a foothold on the underlying host. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page, so the Chrome instance must be reachable through normal browser browsing activity.

• AuthenticationNot required

  No credentials or account are needed; any unauthenticated remote attacker can attempt the exploit once the victim visits the malicious page.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker must socially engineer a user into visiting an attacker-controlled or compromised site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions or race-condition requirements beyond the renderer compromise precondition noted in the advisory.

Blast Radius

• An attacker who triggers the bug escapes the Chrome sandbox, breaking the primary isolation boundary between browser content and the host operating system.
• With sandbox escape achieved, the attacker reads files and data accessible to the Chrome process user, including session tokens, cookies, and credentials stored on disk.
• The attacker can write to the filesystem or inject code into other processes running under the same user account, modifying persisted application data.
• The attacker can crash or disrupt the Chrome process and any co-located services, causing denial of service on the affected host.