CVE-2026-13779: Chromoting Use-After-Free on ChromeOS – Patch Guidance

Technical summary

CVE-2026-13779 is a use-after-free vulnerability (CWE-416) in Chromoting, Chrome's remote desktop protocol handler on ChromeOS. The flaw arises when the application references memory that has already been freed, potentially allowing an attacker to corrupt the heap or inject executable code. The attack surface is network-facing: a remote attacker can trigger the vulnerability by sending malicious network packets without user interaction or special privileges. The CVSS 3.1 vector (8.1/HIGH, AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact, with network accessibility but requiring specific (though not unreasonable) conditions to exploit.

Business impact

This vulnerability poses direct risk to ChromeOS users who rely on Chromoting for remote support or remote desktop access. A successful exploitation could allow unauthorized code execution with user-level privileges, enabling attackers to steal credentials, access corporate data, deploy malware, or compromise the integrity of business workflows. Organizations supporting remote work over ChromeOS devices or providing remote assistance via Chromoting should treat this as a priority. The lack of current KEV exploitation data does not diminish the practical risk—critical memory safety flaws in network-facing remote access code are historically high-value targets.

Affected systems

Google Chrome on ChromeOS prior to version 150.0.7871.47 is affected. The vulnerability does not impact Chrome on Windows, macOS, or Linux according to the published description. ChromeOS devices running unpatched Chrome builds are at immediate risk, particularly in corporate environments where device management may lag behind release cycles.

Exploitability

The vulnerability requires network access and no user interaction, but does carry a high exploitation complexity. While remote attackers can send packets to trigger the flaw without authentication or user involvement, reliable exploitation likely demands precise heap manipulation or deep knowledge of Chromoting's memory layout. The absence of public exploit code and KEV listing as of now suggests active exploitation has not been widespread, but this should not be interpreted as low exploitability—use-after-free flaws in remote code paths are inherently dangerous and the complexity factor may simply reflect the technical skill required rather than true safety.

Remediation

Update Google Chrome on ChromeOS to version 150.0.7871.47 or later. Organizations should prioritize deployment of this patch, particularly for devices used in support roles or accessible from untrusted networks. Verify the update against Google's official security advisories to confirm patch application. No workarounds are available; patching is the only mitigation.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later on all ChromeOS devices. Automatic updates should be enabled where policy allows. Manual patch verification: open Chrome, navigate to chrome://settings/help, and confirm the version number matches or exceeds 150.0.7871.47. For managed deployments, use ChromeOS management console to verify rollout completion. Test Chromoting functionality post-patch to ensure continuity of remote support workflows.

Detection guidance

Monitor for suspicious network traffic targeting Chromoting (typically port 5900 or through Google's relay infrastructure). Log and alert on unexpected Chromoting connection attempts, especially from external IP ranges. Inspect process execution logs for Chrome spawning unusual child processes post-Chromoting session. Endpoint detection and response (EDR) tools should flag memory corruption indicators (heap exceptions, unexpected segfaults in Chrome processes). Review Chrome crash reports via chrome://crashes for any pre-patch incidents that might correlate with exploitation attempts.

Why prioritize this

This vulnerability should be patched urgently despite not yet appearing on the CISA KEV catalog. The combination of network accessibility, absence of authentication, no user interaction requirement, and a Critical severity rating from Google's own assessment make this high-priority. Use-after-free in remote code paths is a classic attack vector. Organizations should not wait for exploitation trends; proactive patching of memory safety vulnerabilities in network-facing remote access code is fundamental security hygiene.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects critical exploitability factors: network access (AV:N) with no authentication (PR:N) or user interaction (UI:N). High complexity (AC:H) reflects the technical skill needed to reliably trigger and exploit the use-after-free condition, but does not negate the risk. The unscoped impact (S:U) on confidentiality, integrity, and availability is complete. Google's Critical designation and the memory safety nature of CWE-416 elevate practical risk above the numerical score. This is a high-priority patch scenario.

Frequently asked questions