CVE-2026-13774: Chrome Extension Use-After-Free RCE Vulnerability – Patch 150.0.7871.47

Technical summary

CVE-2026-13774 is a use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome. The flaw allows an attacker to reference memory that has already been freed, leading to memory corruption and arbitrary code execution. The attack requires user interaction—specifically, convincing a user to install a malicious extension—but once installed, the extension can execute code outside the normal sandbox constraints. The vulnerability was patched in Chrome 150.0.7871.47 and affects Windows, macOS, and Linux systems.

Business impact

Organizations relying on Chrome for enterprise workstations face elevated risk if users can be socially engineered into installing untrusted extensions. Successful exploitation could grant attackers persistent code execution within the browser context, enabling credential theft, data exfiltration, session hijacking, and lateral movement within corporate networks. Industries with high-value targets—financial services, healthcare, government—should treat this as a priority remediation item. The attack vector is network-based but depends on user action, reducing the immediate blast radius compared to wormable vulnerabilities.

Affected systems

Google Chrome versions prior to 150.0.7871.47 on Windows, macOS, and Linux are affected. Any organization using older Chrome deployments or those that auto-update may have gaps during the patching window. Users of Chrome-based applications (Electron, Chromium derivatives) and managed environments using Chrome policies should audit their rollout status. Note: the affected systems list includes reference to macOS, Windows, and Linux kernel—Chrome runs on all three platforms and depends on OS-level memory management.

Exploitability

Exploitation requires social engineering to convince a user to install a malicious extension. This is a meaningful barrier compared to remote, user-interaction-free attacks, but phishing campaigns, watering holes, and app store poisoning make it a realistic threat. Once a malicious extension is installed, code execution is reliable. The CVSS vector reflects high complexity (AC:H) due to the user action requirement, but the potential impact—confidentiality, integrity, and availability all compromised—is severe. No public exploit code has been reported in the KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation is not yet widespread, though this does not eliminate the risk.

Remediation

Organizations must deploy Chrome 150.0.7871.47 or later across all endpoints. For managed environments, use Chrome policies (ExtensionInstallBlocklist, ExtensionInstallForcelist) to restrict which extensions can be installed and prevent users from installing extensions without IT approval. Establish clear communication about extension installation risks. Monitor extension usage via Chrome reporting tools and EDR solutions. Consider user training on phishing and social engineering tactics used to distribute malicious extensions.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism should roll out the patch automatically on next restart for most users, but verify deployment in managed environments. Enterprises using Google Admin Console can track rollout status via device inventory reports. Test updates in a staging environment if your organization requires change control. No backward compatibility issues are expected with this security patch. Verify patch application by checking Chrome's About page (chrome://help) which will show the current version and confirm update success.

Detection guidance

Monitor for unusual extension installations via browser logs, endpoint detection and response (EDR) tools, or Chrome reporting dashboards. Inspect installed extensions for unknown or suspicious publishers. Check browser history for extension store pages and download sources. Use network detection to flag suspicious certificate or code-signing patterns associated with malicious extensions. EDR tools may detect post-exploitation behavior (privilege escalation, credential access) that follows successful use-after-free exploitation. Endpoint behavioral analysis should flag memory corruption patterns or unexpected process creation from the Chrome process.

Why prioritize this

This vulnerability merits urgent attention despite its HIGH CVSS score due to Chrome's ubiquity, the severity classification from Chromium maintainers, and the high confidentiality/integrity/availability impact. The user-interaction requirement mitigates some risk, but social engineering campaigns targeting this vector are a known threat tactic. Organizations with strict extension policies and user training have lower risk; those with permissive BYOD policies or high-value targets should patch immediately.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects the severe impact (arbitrary code execution affecting confidentiality, integrity, and availability) tempered by the high attack complexity (user must install a malicious extension). The attack vector is network-based, but the exploit chain requires convincing a user, not automated delivery. This score correctly places the vulnerability in the HIGH severity band and justifies prioritization, but the actual organizational risk depends on how well extension policies are enforced and how susceptible users are to social engineering.

Frequently asked questions