CVE-2026-13804: Chrome Chromecast Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-13804 is a use-after-free (CWE-416) vulnerability in Chrome's Chromecast implementation. Use-after-free occurs when code attempts to access memory that has already been freed, potentially allowing an attacker to control that memory and execute arbitrary code. In this case, the vulnerability exists in Chromecast handling within the renderer process. Exploitation requires the attacker to have already compromised the renderer process, then deliver a crafted HTML page to trigger the memory safety flaw. Successful exploitation results in sandbox escape—breaking out of the restricted execution environment that normally confines renderer process code. The Chromium project assigned this a High security severity rating, and the CVSS 3.1 score of 8.3 reflects the high confidentiality, integrity, and availability impact, tempered by the elevated attack complexity and user interaction requirement.

Business impact

A sandbox escape in Chrome represents a significant security risk because the renderer process is intentionally isolated to contain the damage from web-based attacks. Successful exploitation could allow an attacker with renderer access to read sensitive files, modify system data, or install malware with user-level privileges. Organizations relying on Chrome for sensitive work—especially those processing confidential information or accessing critical systems—should prioritize patching. The practical impact depends on the user's system role and what data or resources are accessible from their device.

Affected systems

This vulnerability affects Google Chrome versions prior to 150.0.7871.47. All platforms running affected Chrome versions are at risk. Verify your organization's installed Chrome version against the vendor advisory to confirm exposure. Chrome's auto-update mechanism means many users may already have received patches, but enterprises with managed deployment or users who have not restarted their browsers should verify patch status.

Exploitability

Exploitation is not straightforward but remains credible. An attacker must first achieve renderer process compromise—typically through a separate web-based vulnerability or social engineering—then deliver the crafted HTML page to trigger the use-after-free. The attack chain is not a one-click affair, but the technique is within reach of well-resourced threat actors. The requirement for user interaction (visiting the malicious page) and elevated attack complexity provide some friction. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild has not yet been documented, but defenders should not assume it is unexploitable.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's built-in auto-update feature should deploy the patch automatically, but users should manually check for updates and restart their browser to ensure the patch is active. In managed environments, IT teams should verify patch deployment through their endpoint management tools and confirm that auto-update policies are enforced. Verify against the official Google Chrome release notes to confirm patch version applicability to your deployment.

Patch guidance

Users: Navigate to Chrome menu > Help > About Google Chrome. The browser will check for updates and prompt to restart if a patch is available. Confirm the version number after restart matches 150.0.7871.47 or later. Enterprise teams: Verify patch deployment status through your MDM/endpoint management platform. Check Chrome policies to ensure auto-updates are enabled. Consider blocking older Chrome versions from accessing sensitive systems until patches are verified. Test patch compatibility in a lab environment before broad deployment if your organization customizes Chrome policies or extensions.

Detection guidance

Monitor Chrome version numbers across your endpoints to identify systems still running versions prior to 150.0.7871.47. Check browser update logs and endpoint management dashboards for patch deployment status. At the network level, intrusion detection systems may flag exploitation attempts through unusual Chromecast-related memory access patterns or renderer process crashes, though the vulnerability itself does not produce distinctive network signatures. Focus detection efforts on identifying unpatched systems and confirming patch deployment rather than on detecting active exploitation, given the low current evidence of in-the-wild attacks.

Why prioritize this

While this vulnerability requires renderer process compromise as a prerequisite, the sandbox escape impact is severe and affects a ubiquitous browser. The CVSS 8.3 score reflects high severity. Organizations should prioritize patching Chrome within their standard update windows—typically within 1–2 weeks—and accelerate timelines for high-risk users who handle sensitive data or interact with untrusted content. Given that no active exploitation has been documented and attack complexity is elevated, this is not an emergency patch, but it should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH severity) reflects the combination of network-based attack vector, high impact to confidentiality, integrity, and availability (sandbox escape implications), and the need for user interaction and elevated attack complexity. The score appropriately captures the severity of a sandbox escape while acknowledging that the attack requires prior renderer compromise and cannot be trivially exploited. This score aligns with Chromium's own High severity rating for the issue.

Frequently asked questions