CVE-2026-13869: Use after free in Device in Google Chrome on Windows prior to 150

Synopsis

A use-after-free vulnerability affects the Device component of Google Chrome on Windows in versions prior to 150.0.7871.47. The flaw is reachable over the network without any account credentials, but requires a user to visit a crafted HTML page; it also requires that the attacker has already compromised the Chrome renderer process. Successful exploitation enables a full sandbox escape, giving the attacker the ability to read, write, and crash processes outside the browser sandbox. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target Chrome instance must be reachable or the user must browse to an attacker-controlled origin.

• AuthenticationNot required

  No account credentials or prior authentication are needed; the attack is launched from an unauthenticated network position.

• Victim interactionRequired

  The user must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions or specific memory-layout conditions, though a prior renderer compromise is a prerequisite.

Blast Radius

• A successful sandbox escape lets the attacker read files, credentials, and session data accessible to the Chrome process on the Windows host.
• The attacker gains the ability to write or modify files and registry entries outside the browser sandbox.
• The attacker can crash or terminate processes running under the compromised user account, disrupting the host.
• With code execution outside the sandbox, the attacker can pivot to other processes or escalate privileges on the Windows system.