CVE-2026-13880: Use after free in USB in Google Chrome on Mac prior to 150

Synopsis

A use-after-free vulnerability in the USB component of Google Chrome on macOS affects all Chrome versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but does require a victim to visit a crafted HTML page; exploitation also requires the attacker to have already compromised the Chrome renderer process. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the Chrome sandbox with access to system resources. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable by or capable of connecting to attacker-controlled web content.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs to get the victim to load a crafted page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, making this a social-engineering vector requiring at least one user action such as clicking a link or navigating to a malicious site.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and reproducible without depending on race conditions or specific environmental layout, though it does require a pre-compromised renderer process as a prerequisite.

Blast Radius

• A successful attacker escapes the Chrome sandbox on macOS, gaining code execution in the context of the browser process rather than the restricted renderer.
• With sandbox escape achieved, the attacker reads files and credentials accessible to the logged-in user, including keychain items, cookies, and stored passwords.
• The attacker writes or modifies files on the host filesystem within the user's permissions, enabling persistence mechanisms or tampering with local application data.
• The attacker can crash or destabilize the host Chrome process and any dependent services, causing a denial of service for the affected user session.