CVE-2026-13861: Use after free in Core in Google Chrome prior to 150

Synopsis

A use-after-free vulnerability in the Core component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape Chrome's sandbox by luring a victim to a crafted HTML page. The flaw is reachable over the network and requires no authentication, only that the victim visit or interact with attacker-controlled content. Successful exploitation gives the attacker full control outside the browser sandbox, enabling arbitrary code execution, data theft, and system tampering. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's browser must be able to reach attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must visit or interact with a crafted HTML page, making this a social-engineering or malicious-link scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors, though it does require a prior renderer compromise as a stepping stone.

Blast Radius

• A successful attacker escapes Chrome's renderer sandbox and gains code execution in the context of the browser process or the underlying OS user account.
• Confidential data accessible to that user account, including stored credentials, session cookies, and local files, is exposed to the attacker.
• The attacker can write or modify files and system state on the host, enabling persistence, lateral movement, or payload installation.
• The affected browser session and any services it holds open can be disrupted or hijacked entirely.