CVE-2026-13909: Insufficient policy enforcement in DevTools in Google Chrome prior to 150

Synopsis

This is an insufficient policy enforcement vulnerability in Google Chrome's DevTools component affecting versions prior to 150.0.7871.47. The vulnerability is reachable over the network and requires no authentication, but does require a victim to interact with a crafted HTML page; additionally, the attacker must have already compromised the Chrome renderer process. Successful exploitation enables a full sandbox escape, giving the attacker read access to sensitive data, the ability to modify files or browser state, and the ability to disrupt the affected process, all at high impact across confidentiality, integrity, and availability. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for environments running an affected version of Chrome.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's browser must be reachable from or directed to an attacker-controlled network resource.

• AuthenticationNot required

  No account or credential is needed; the attack is launched by getting the victim to load a crafted page from an unauthenticated remote location.

• Victim interactionRequired

  The victim must navigate to or be socially engineered into opening a crafted HTML page, giving the attacker the opportunity to trigger the policy enforcement flaw.

• Attack complexityDetail

  Exploit reliability is high once the renderer process is compromised; no race conditions or specific memory layout requirements are imposed by the vulnerability itself, though the prerequisite renderer compromise adds situational complexity.

Blast Radius

• A successful sandbox escape lets the attacker read files and data outside the Chrome sandbox, including stored credentials, session tokens, and local user files.
• The attacker gains the ability to write or modify files and browser state on the host, enabling persistence or data tampering.
• The attacker can crash or disrupt the Chrome process and any dependent browser sessions, causing a denial of service for the affected user.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser sandbox to resources controlled by the underlying operating system.