CVE-2026-13787: Critical Use-After-Free in Google Chrome Chromoting on Windows

Technical summary

CVE-2026-13787 is a use-after-free vulnerability (CWE-416) in the Chromoting component of Google Chrome prior to version 150.0.7871.47 on Windows platforms. The vulnerability exists in memory management within the remote desktop subsystem, where freed memory can be referenced and manipulated by an attacker sending malicious network traffic. Chromium's security team rated this as Critical severity. The CVSS 3.1 score of 8.1 (HIGH) reflects high confidentiality, integrity, and availability impact, though exploitation requires specific network conditions (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Business impact

Organizations relying on Chrome's remote desktop capabilities for secure employee access face potential compromise of endpoint security. If exploited, an attacker gains code execution with Chrome's privileges, potentially leading to lateral movement, data exfiltration, or malware deployment. The network-based attack vector means exposure extends beyond trusted internal networks if Chromoting is accessible remotely. Interruption of remote work capabilities may also occur if systems are compromised or taken offline for remediation.

Affected systems

Google Chrome versions prior to 150.0.7871.47 running on Windows operating systems are affected. The vulnerability specifically impacts installations using Chromoting for remote access. Systems running Chrome on other operating systems (macOS, Linux) are not affected by this particular vulnerability. The scope is limited to the Chromoting feature; other Chrome functionality is not impacted.

Exploitability

The vulnerability requires network access and the target system must have Chrome with Chromoting active. While exploitation demands specific network conditions (reflected in the AC:H factor), the absence of privilege requirements or user interaction significantly lowers the bar for attackers. Opportunistic exploitation via network scanning for accessible Chromoting instances is plausible. The attack does not yet appear in public exploit databases or on the CISA Known Exploited Vulnerabilities list as of the current data.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later. On Windows systems with managed Chrome deployments, enforce automatic updates or use Group Policy to push the patched version. For organizations unable to update immediately, disable Chromoting if remote access is not essential, or restrict Chromoting access via firewall rules to trusted networks only. Verify the patch version against Google's official security release notes before deployment.

Patch guidance

Deploy Chrome version 150.0.7871.47 or any subsequent release across all Windows endpoints. Organizations using Chrome Enterprise should prioritize rapid rollout through their update management systems. Test the patch in a limited environment first to ensure compatibility with any third-party remote access integrations. Verify completion of updates by checking Chrome's About page (chrome://settings/help) or using enterprise deployment reporting tools. Consider enabling automatic updates if not already active to prevent similar delays in future patches.

Detection guidance

Monitor for Chrome crashes or abnormal terminations on Windows systems, particularly those with Chromoting enabled. Network-based detection is challenging without signature-level analysis; prioritize patch deployment over detection. Log and alert on any unauthorized Chromoting session initiations or unexpected Chromoting traffic from external sources. Endpoint detection and response (EDR) solutions may flag suspicious memory access patterns within Chrome processes if behavioral detection is configured. Audit Chromoting access logs for unusual connection attempts or geographic anomalies.

Why prioritize this

This vulnerability merits high priority due to its Critical Chromium rating, remote exploitability without user interaction, and potential for arbitrary code execution. The use-after-free class is particularly dangerous in memory-unsafe contexts. However, the AC:H factor and lack of current public exploitation provide a brief window for controlled patching. Organizations should treat this as urgent but not emergency-tier if patching processes are already in motion. Delayed patching beyond 30 days increases risk materially.

Risk score, explained

The CVSS 8.1 score reflects a HIGH severity assessment driven by maximum impact across confidentiality, integrity, and availability (all HIGH). Network accessibility (AV:N) and lack of privilege or user interaction requirements (PR:N/UI:N) are primary risk drivers. The AC:H (High complexity) factor is the primary mitigator, indicating that successful exploitation requires specific conditions—such as precise network timing or specific Chrome state—that an attacker cannot always guarantee. The single system scope (S:U) limits lateral impact within the CVSS model but does not reduce the severity of code execution on the affected host.

Frequently asked questions