CVE-2026-13901: Insufficient policy enforcement in Serial in Google Chrome prior to 150

Synopsis

This is a sandbox escape vulnerability in Google Chrome's Serial API, affecting all versions prior to 150.0.7871.47. The flaw is reachable over the network and requires no authentication, but a victim must visit a crafted HTML page, and the attacker must have already compromised the renderer process. Successful exploitation lets an attacker break out of Chrome's sandbox, gaining the ability to read, modify, or destroy data and processes beyond the browser's normal isolation boundary. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a crafted HTML page, so the Chrome instance must be reachable via a browser session.

• AuthenticationNot required

  No account credentials or session tokens are required; the attack is launched from an unauthenticated web page.

• Victim interactionRequired

  The victim must open a crafted HTML page, making this a social-engineering-dependent attack that requires at least one user action.

• Attack complexityDetail

  Attack complexity is rated Low, meaning the exploit is reliable and does not depend on race conditions or special environmental layout, though a prior renderer compromise is a prerequisite.

Blast Radius

• An attacker who escapes the sandbox can read files and process memory outside the browser's isolation boundary, including stored credentials and session data.
• The attacker gains the ability to write or modify files and data accessible to the browser process user on the host.
• The attacker can crash or terminate the affected service or broader host processes, causing a denial of service.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser to other components or containers sharing the host environment.