CVE-2026-13920: Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150

Synopsis

This is a sandbox escape vulnerability in the Media component of Google Chrome on Windows, affecting all versions prior to 150.0.7871.47. An attacker who has already compromised Chrome's renderer process can exploit insufficient input validation by delivering a crafted HTML page to the victim, breaking out of the browser's sandbox and gaining access to the underlying Windows host. Successful exploitation grants the attacker full confidentiality, integrity, and availability impact on the host system. A patched-image rebuild at version 150.0.7871.47 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network, delivering a crafted HTML page to a browser running on an exposed or reachable Windows host.

• AuthenticationNot required

  No authentication is required; the attack can be launched by any unauthenticated remote party who can get the crafted page in front of the victim.

• Victim interactionRequired

  The victim must open or be directed to the attacker-controlled HTML page, requiring a social-engineering step such as a phishing link or malicious redirect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and places no special environmental conditions or timing constraints on the attacker beyond the pre-compromised renderer prerequisite.

Blast Radius

• An attacker who succeeds reads arbitrary files, credentials, and secrets stored on the Windows host outside the browser sandbox.
• The attacker writes to or modifies files and system state on the host, enabling persistence mechanisms or lateral movement artifacts.
• The attacker can crash or disrupt the host operating system or any running services, causing a denial of service beyond the browser process.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser itself to other processes and resources on the same Windows machine.