CVE-2026-13033: Critical Out-of-Bounds Memory Vulnerability in Chrome InterestGroups

Technical summary

CVE-2026-13033 is an out-of-bounds (OOB) read and write vulnerability in the Blink rendering engine's InterestGroups implementation. The flaw stems from improper bounds checking when processing interest group data structures, allowing an attacker to access and modify memory regions beyond allocated buffers. This violates memory safety assumptions and can be leveraged to overwrite adjacent objects or read sensitive data. The vulnerability is triggered through a specially crafted HTML document, requiring only user interaction (visiting a webpage) and network access. The combination of read and write capabilities provides a direct path to arbitrary code execution in the Chrome sandbox context.

Business impact

This vulnerability enables remote code execution with minimal user friction—a user simply needs to visit a compromised or attacker-controlled website. For enterprises, this represents a high-risk threat vector that could lead to credential theft, malware installation, data exfiltration, or lateral movement within corporate networks. Given Chrome's widespread use in both personal and professional settings, the exposure is substantial. Organizations relying on Chrome as a primary browser face elevated risk until patching is completed.

Affected systems

The vulnerability directly affects Google Chrome versions prior to 149.0.7827.197. Because Chromium powers browsers across multiple platforms and derivatives, the impact extends to users on Windows, macOS, Linux, and Chromium-based browsers. The source data lists Google Chrome, Apple macOS, Linux kernel, and Microsoft Windows as affected vendors/products, reflecting the cross-platform nature of the vulnerability's reach.

Exploitability

This vulnerability is exploitable with a low attack complexity and no privileges required. An attacker only needs to trick a user into visiting a malicious or compromised website—a common attack vector. The user interaction requirement (visiting a link or page) is minimal and easily social-engineered. No KEV record currently exists, but the critical severity rating and straightforward attack chain suggest active exploitation is a realistic near-term risk.

Remediation

Update Google Chrome to version 149.0.7827.197 or later immediately. Verify the installed version via Chrome's About page (chrome://about), which will auto-check for updates. Organizations should prioritize this patch across all devices, as the attack surface is browser-based and doesn't require system-level access. Chromium-based browsers (Edge, Brave, Opera, etc.) should also check their respective update channels, though patch timelines may vary by vendor.

Patch guidance

Apply Chrome version 149.0.7827.197 or later as soon as available in your environment. Use Chrome's built-in auto-update mechanism, or manually trigger updates via Settings > About Chrome. For enterprise deployments, push this update through your mobile device management (MDM) or enterprise patch management system with high priority. Verify patch application across client devices before moving to lower-priority updates. Chromium-based alternatives should be updated through their respective channels; consult vendor advisories for patch availability and version numbers.

Detection guidance

Monitor for signs of post-exploitation activity rather than the exploit itself, since the vulnerability is memory corruption occurring in-process. Look for unusual process behavior after Chrome activity: unexpected child processes, suspicious network connections, file system modifications, or credential access attempts. Web proxy logs may reveal visits to known malicious sites hosting exploit payloads—flagging unusual or suspicious domains accessed via Chrome is a secondary detection layer. Endpoint detection and response (EDR) tools should monitor for post-compromise indicators such as process hollowing, DLL injection, or lateral movement attempts originating from Chrome processes.

Why prioritize this

This vulnerability warrants top-tier prioritization due to its combination of critical severity, low exploitation barriers, and broad user base exposure. The attack requires only a web visit and leads to arbitrary code execution—making it a primary vector for malware distribution and data theft. The lack of KEV designation does not diminish urgency; the Chromium security team's critical rating and remote+user interaction attack chain indicate imminent real-world exploitation risk.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-exploitable vulnerability requiring minimal user interaction, with complete impact on confidentiality, integrity, and availability. While the score aligns with 'HIGH,' Chromium's critical designation acknowledges the practical severity in a browser context where exploitation directly enables malware execution. Organizations should treat this as a critical business risk despite the numeric 'HIGH' label.

Frequently asked questions