CVE-2026-13802: Chrome Use-After-Free in Views (RCE, CVSS 7.5)

Technical summary

This vulnerability is a use-after-free (CWE-416) in Chrome's Views subsystem, a core UI framework. The flaw allows memory that has been freed to be referenced or executed, leading to arbitrary code execution. The attack vector is network-based, requiring no privilege escalation, but does require user-initiated UI gestures to trigger the vulnerable condition. The Chromium project assessed this as High severity; it affects the confidentiality, integrity, and availability of the browser process.

Business impact

Exploitation could lead to malware installation, credential theft, session hijacking, and unauthorized access to sensitive data processed through Chrome. Organizations with heavy Chrome usage—particularly those where users browse untrusted content or receive phishing emails with malicious links—face elevated risk of compromise. The need for user interaction limits mass exploitation but does not eliminate it in targeted or social-engineering scenarios.

Affected systems

All Google Chrome installations prior to version 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, Android, and iOS deployments. Chromebooks running Chrome OS are equally affected until patched. Enterprise environments with older Chrome versions or delayed patch cycles require immediate attention.

Exploitability

Exploitation requires two conditions: (1) the user must visit a malicious or compromised webpage, and (2) the user must interact with the UI in a specific way that triggers the vulnerable code. This means drive-by attacks are possible but not automatic; attackers typically use social engineering, malicious advertisements, or compromised legitimate sites to increase the probability of user interaction. The CVSS vector reflects the high impact but moderate difficulty (AC:H) of triggering the flaw consistently.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Verify the update is applied via Settings > About Google Chrome or by checking chrome://version. For managed environments, push updates via your device management platform to ensure compliance across all endpoints. Backports or security updates for older Chrome branches may be available; consult Google's Chrome release notes.

Patch guidance

Apply Chrome version 150.0.7871.47 or any later version. Google typically delivers updates automatically; verify installation by restarting the browser and confirming the version number. For enterprises using Chrome Enterprise, deploy via your policy management console to enforce update deployment across the fleet. Monitor rollout to confirm no compatibility issues arise before full deployment.

Detection guidance

Monitor for Chrome crash reports or sandbox escape attempts, though they may not be logged on the endpoint. Web proxy or DNS logs may reveal connections to known malicious sites hosting exploits. Behavioral analysis for unusual child processes spawned by Chrome, particularly those with high privilege or network activity, could indicate post-exploitation activity. Endpoint detection and response (EDR) tools should flag use-after-free crashes or suspicious memory access patterns. Review browser update status reports to identify machines still running vulnerable versions.

Why prioritize this

While CVE-2026-13802 is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the combination of high CVSS score (7.5), arbitrary code execution capability, network attack vector, and prevalence of Chrome globally makes this a priority fix. The requirement for user interaction reduces urgency slightly compared to wormable flaws, but organizations should treat this as a near-immediate remediation target—delay increases risk of targeted or mass compromise.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the severity of arbitrary code execution balanced against the user interaction requirement. The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H indicates: network attack vector (AV:N), high attack complexity (AC:H) due to the need to trigger specific UI gestures, no privilege required (PR:N), user interaction required (UI:R), and full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The HIGH severity is warranted given the impact, even with the interaction requirement.

Frequently asked questions