CVE-2026-13026: Chrome macOS Use-After-Free in Digital Credentials (CVSS 8.8)

Technical summary

CVE-2026-13026 is a use-after-free vulnerability (CWE-416) in the Digital Credentials component of Google Chrome on macOS. Use-after-free occurs when memory is accessed after it has been freed, potentially allowing an attacker to manipulate heap structures. In this case, a remote attacker could craft a malicious HTML page that, when visited by a user, triggers the flaw and causes heap corruption. The Chromium security team assigned this a High severity rating, reflected in the CVSS 3.1 score of 8.8.

Business impact

Successful exploitation could result in complete compromise of the affected user's Chrome browser session, including theft of sensitive data, credential theft from stored passwords or payment information, and malware installation. For enterprises, compromised developer machines or executive workstations running vulnerable Chrome on macOS could be leveraged for lateral movement, data exfiltration, or supply-chain attacks. The requirement for user interaction (visiting a crafted page) means phishing or watering-hole campaigns are the primary attack vectors.

Affected systems

Google Chrome for macOS versions prior to 149.0.7827.197 are vulnerable. This affects users on Apple's macOS platform running unpatched Chrome installations. No other Chrome platforms (Windows, Linux, Android, iOS) are mentioned as affected by this specific flaw, though users should verify patch status against official Chrome release notes.

Exploitability

The vulnerability requires user interaction—a victim must visit a crafted webpage—but requires no authentication or special privilege. The attack surface is broad because any attacker-controlled or compromised website could host the malicious HTML. The CVSS vector (AV:N/AC:L/PR:N/UI:R) reflects low complexity, network accessibility, and user interaction as the only barrier. While not trivial to exploit reliably, the ease of delivery via a link or email makes this practical for targeted attacks.

Remediation

Update Google Chrome on macOS to version 149.0.7827.197 or later. Users should enable Chrome's automatic update feature, which is the default configuration. Administrators managing macOS fleet deployments should validate patch deployment and monitor for successful installation. This is a straightforward remediation with no known workarounds; updating is the only mitigation.

Patch guidance

Check your Chrome version by navigating to Chrome > About Google Chrome on macOS. If automatic updates are enabled, Chrome should upgrade itself when version 149.0.7827.197 becomes available and the browser is restarted. For managed deployments, use your Mobile Device Management (MDM) or configuration management system to push Chrome version 149.0.7827.197 or later. Verify patch installation by confirming the version number post-restart. Note the vulnerability was published on June 24, 2026, and patched in version 149.0.7827.197; confirm exact availability dates against official Chrome release notes.

Detection guidance

Monitor Chrome version reporting in your endpoint detection and response (EDR) platform or asset inventory to identify macOS systems still running Chrome versions prior to 149.0.7827.197. Check browser security logs and HTTP proxy records for suspicious activity or unexpected page loads that might indicate exploitation attempts. While this flaw does not appear in CISA's Known Exploited Vulnerabilities catalog as of the published date, monitor security feeds for any evidence of active exploitation in the wild.

Why prioritize this

This vulnerability merits urgent patching despite not yet being tracked as actively exploited. The combination of high CVSS score (8.8), ease of delivery through web browsing, potential for complete browser compromise, and risk to both individual and enterprise environments justifies high priority. macOS users and organizations managing sensitive workflows on Chrome should treat this as critical and patch within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects high severity: network-accessible attack vector, low complexity, no privilege requirement, user interaction required, and impact on confidentiality, integrity, and availability. The score appropriately balances the serious nature of heap corruption and potential code execution against the user-interaction requirement. The vulnerability does not appear on CISA's KEV catalog, indicating no known widespread exploitation at publication, but the severity and ease of weaponization suggest it could attract attacker attention quickly.

Frequently asked questions