CVE-2026-13801: Chrome Integer Overflow Sandbox Escape Vulnerability

Technical summary

CVE-2026-13801 is an integer overflow vulnerability (CWE-472) in Chromecast's implementation within Google Chrome. Integer overflows occur when arithmetic operations produce values that exceed the maximum size a variable can hold, causing the value to wrap around unexpectedly. This particular flaw exists in code prior to Chrome version 150.0.7871.47. The vulnerability chain requires two conditions: first, the attacker must compromise or control the renderer process (the sandboxed JavaScript engine), and second, the victim must interact with attacker-controlled HTML content. When these conditions are met, the integer overflow can be weaponized to break the sandbox boundary, giving code at the OS level privileges. Google assigned this a High severity rating within Chromium's own security classification.

Business impact

A successful exploitation could result in arbitrary code execution on affected systems with the privileges of the logged-in user. This threatens confidentiality, integrity, and availability of data accessible from that machine—including credentials stored in the browser, files on disk, and access to connected networks. For organizations where Chrome is the primary or mandated browser, widespread exploitation could compromise employee workstations at scale. The attack requires user interaction (visiting a malicious page), which makes targeted phishing campaigns a realistic threat vector. Organizations should prioritize patching systems that handle sensitive data or maintain elevated network access.

Affected systems

Google Chrome prior to version 150.0.7871.47 on Windows, macOS, and Linux. The vulnerability is specific to Chrome's Chromecast implementation, so any Chrome installation is potentially vulnerable until updated. Linux distributions packaging Chrome, macOS systems with Chrome installed, and Windows endpoints running Chrome all require patching. Enterprise deployments using older Chrome versions in managed environments are at particular risk.

Exploitability

Exploitation requires two prerequisites: a compromised or attacker-controlled renderer process and user interaction to load a crafted HTML page. The renderer process compromise could result from a separate Chrome vulnerability or may be simulated in targeted attacks where an attacker has already gained partial browser control. The user interaction requirement (visiting a malicious site) is a practical barrier but not insurmountable in phishing or watering-hole scenarios. The CVSS score of 8.3 (High) reflects the severity of the outcome balanced against these preconditions. This is not a wormable vulnerability, and it cannot be exploited by simply hosting a webpage—attackers must first establish some control over the rendering environment.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. This patch directly addresses the integer overflow in the Chromecast code path. Verify the update is applied by checking Chrome's version in Settings > About > Chrome (which will auto-check and install updates if enabled). For managed environments, deploy the patch through your standard Chrome update mechanism or mobile device management (MDM) platform. As a compensating control, restrict access to untrusted websites and disable Chrome extensions from untrusted sources, though these do not fully mitigate the risk and should not delay patching.

Patch guidance

Obtain Chrome 150.0.7871.47 or later from Google's official channels (google.com/chrome). In enterprise settings, verify your update mechanism is configured to distribute this version. For macOS, the update is delivered via the automatic update process or the Mac App Store if Chrome was installed that way. For Linux, check your distribution's package manager or use the official Google Chrome repository. Verify successful patching by navigating to chrome://version/ and confirming the version string shows 150.0.7871.47 or higher. Document patch deployment in your change management system and test critical workflows after updating to ensure no regression.

Detection guidance

Monitor Chrome version numbers across your environment using endpoint detection and response (EDR) tools, mobile device management (MDM) for managed devices, or by querying installed software inventories. Look for any Chrome installations below version 150.0.7871.47. In network logs, watch for suspicious renderer process behavior or unexpected system calls attempting to escape sandbox restrictions, though detection is difficult without additional context. If you suspect an attack targeting this vulnerability, examine browser process crash logs and system event logs for abnormal activity around the time a user visited a suspicious webpage. Behavioral indicators include renderer process crashes, unexpected system service spawning, or file modifications by the Chrome process.

Why prioritize this

This vulnerability merits immediate attention because it enables a complete sandbox escape—a critical capability for attackers. While it requires an initial renderer compromise and user interaction, the consequences are severe: unrestricted code execution at the OS level. Organizations running older Chrome versions should prioritize this patch before applying routine updates. The fact that it is not yet in CISA's KEV (Known Exploited Vulnerabilities) catalog as of the publication date suggests active exploitation has not been widely observed, but this is an ideal window to patch before such activity emerges.

Risk score, explained

The CVSS 3.1 score of 8.3 (High) reflects the combination of high-impact consequences (confidentiality, integrity, and availability all marked as High), network-based attack vector, and user interaction requirement. The attack complexity is marked as High due to the prerequisite of a compromised renderer process, which prevents an even higher score. The scope is marked as Changed, indicating that the vulnerability can affect resources beyond the vulnerable component itself (the sandbox boundary is crossed). This score appropriately captures a critical but not trivial-to-exploit vulnerability.

Frequently asked questions