CVE-2026-13805: Chrome GFX Use-After-Free on macOS – CVSS 8.8

Technical summary

CVE-2026-13805 is a use-after-free vulnerability (CWE-416) in the GFX subsystem of Chromium-based browsers, specifically impacting Chrome on macOS prior to version 150.0.7871.47. Use-after-free flaws occur when a program attempts to access memory that has already been freed, potentially allowing an attacker to control that memory and redirect execution. In this case, the flaw resides in graphics processing code, a common attack surface in browser engines. The vulnerability requires user interaction (visiting a crafted webpage) and network access, but no authentication. The CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability.

Business impact

This vulnerability poses a direct risk to organizations whose employees use Chrome on macOS. Successful exploitation enables arbitrary code execution in the browser's process context, potentially leading to credential theft, malware installation, or lateral movement into corporate networks if Chrome runs with elevated privileges or shares network trust. The requirement for user interaction means targeted phishing or watering-hole attacks are the primary vectors. For organizations managing large macOS fleets, patching cycles and enforcement become critical operational concerns.

Affected systems

Google Chrome on Apple macOS is the primary affected platform. The vulnerability affects all versions prior to 150.0.7871.47. Organizations running Chrome on Windows, Linux, or other Unix-like systems should verify their Chrome version, as the description specifies Mac; however, the underlying GFX code may be shared across platforms—check the official Google Chrome security advisory for the complete scope. Any system where users browse untrusted content using vulnerable Chrome builds is at risk.

Exploitability

Exploitability is moderate to high. The attack requires convincing a user to visit a malicious or compromised website, making it suitable for targeted phishing, drive-by attacks, or watering-hole campaigns against specific industries or organizations. No special browser configuration or user privileges are needed beyond normal web browsing. The network attack vector (AV:N) and lack of required authentication (PR:N) mean an attacker on the public internet can attempt exploitation. However, the attack does require user interaction (UI:R), which adds a small friction point but is easily overcome in social-engineering scenarios.

Remediation

Update Chrome on all macOS systems to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism should handle this, but verify completion across your environment, especially for managed devices. If auto-update is disabled in your organization, manually initiate updates or push them via mobile device management (MDM) or endpoint management tools. Verify the new version number after patching to confirm successful deployment.

Patch guidance

Google Chrome version 150.0.7871.47 or later on macOS contains the fix for this vulnerability. Users can check their version by navigating to Chrome > About Google Chrome, which will also automatically download and install any available updates. For enterprise deployments, use your configuration management or MDM solution to distribute and enforce this update. Verify patch status 7–10 days post-release to identify any systems that may have failed to auto-update or are in use by employees who delay restarts. Test the update in a small group first if your organization has specific macOS or Chrome customizations.

Detection guidance

Monitor Chrome version numbers across your environment using endpoint detection and response (EDR) tools, mobile device management (MDM), or asset-management systems. Check for systems still running versions prior to 150.0.7871.47. In network logs, detection of exploitation attempts is difficult without browser-level or system-level instrumentation; focus on behavioral indicators such as unexpected child processes spawned by Chrome, unusual network connections from the Chrome process, or out-of-process execution following web browsing. EDR tools that hook Windows API or system calls may catch post-exploitation activity. For macOS, monitor system logs for Chrome crashes followed by suspicious activity, and use code-signing verification to detect tampered Chrome binaries.

Why prioritize this

This vulnerability merits immediate prioritization due to its high CVSS score (8.8), remote and network-based attack vector, and the ubiquity of Chrome on macOS in both enterprise and consumer environments. While not yet listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, the combination of high impact, ease of exploitation (no special tools needed), and the high visibility of Chrome security flaws means active exploitation is likely within weeks. Any organization with macOS users should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH severity) reflects a critical threat profile. The network attack vector (AV:N) and lack of required privileges (PR:N) mean any internet-connected attacker can attempt exploitation. The requirement for user interaction (UI:R) prevents worm-like propagation but does not substantially reduce risk in targeted or broad phishing scenarios. The consequence vector (C:H/I:H/A:H) indicates that successful exploitation leads to complete compromise of confidentiality, integrity, and availability within the affected process and potentially beyond (depending on browser privilege isolation and sandbox effectiveness). In a use-after-free attack, the attacker gains arbitrary code execution, which is the highest severity outcome short of kernel-level compromise.

Frequently asked questions