CVE-2026-13810: Chrome Linux Input Validation Flaw Exposes Process Memory

Technical summary

CVE-2026-13810 stems from an inappropriate input validation implementation in the Chromium engine's input handling subsystem on Linux. The vulnerability permits information disclosure (CWE-200) through a network vector requiring user interaction. An attacker can construct a crafted HTML page that, when rendered by a vulnerable Chrome instance, causes the browser to divulge process memory contents to the attacker. The flaw does not enable code execution or denial of service, but the confidentiality impact is rated high given the potential scope of exposed data.

Business impact

Organizations running Chrome on Linux face a confidentiality risk if users are socially engineered into visiting attacker-controlled sites. Potential exposures include cached credentials, authentication tokens, session data, or other sensitive information resident in Chrome's process memory. For enterprises with sensitive workflows on Linux workstations, this could lead to credential compromise and lateral movement if exposed tokens or keys are leveraged by attackers.

Affected systems

Google Chrome on Linux prior to version 150.0.7871.47 is affected. The vulnerability does not impact Chrome on Windows or macOS, nor does it affect the Linux kernel itself (despite the vendor list including a generic 'linux_kernel' entry, the flaw is specific to Chrome's input handling on Linux platforms). Administrators should verify the affected Chrome version across their Linux deployments.

Exploitability

Exploitation is straightforward in terms of attack mechanics: an attacker controls delivery and content of the malicious HTML, and user interaction (visiting the page) is the only prerequisite. No special privileges or complex manipulation is required on the target system. However, the attack requires social engineering or drive-by browsing to succeed. The CVSS score of 6.5 (MEDIUM) reflects the high confidentiality impact tempered by the necessity of user interaction and local scope (the attacker gains information from the user's own process, not system-wide).

Remediation

Update Google Chrome on all Linux systems to version 150.0.7871.47 or later. Verify the update through Chrome's About page (chrome://about or Settings > About Chrome), which will display the current version and initiate auto-update if available. For enterprise deployments, use configuration management or mobile device management (MDM) solutions to enforce the minimum version requirement.

Patch guidance

Google has released Chrome 150.0.7871.47 as the fix. Automatic updates are enabled by default in Chrome; users should ensure they restart the browser to apply the update. Enterprise administrators can verify patch deployment via Chrome's reporting APIs or by querying the version string through system management tools. Verify the installed version matches or exceeds 150.0.7871.47 before considering the system compliant.

Detection guidance

Monitor Chrome version telemetry to identify systems running versions prior to 150.0.7871.47. On Linux endpoints, query the Chrome installation path (typically /opt/google/chrome or ~/.config/google-chrome) and inspect version metadata. EDR or vulnerability scanning tools configured to track application versions will flag outdated Chrome instances. Additionally, monitor network traffic for suspicious HTML-based payloads targeting Chrome, though this is difficult without deep packet inspection.

Why prioritize this

While the CVSS score is MEDIUM (6.5) and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) list, the combination of ease of exploitation, high confidentiality impact, and prevalence of Chrome on Linux development and security-sensitive systems warrants timely patching. Organizations should treat this as a priority update within 1–2 weeks, especially for systems handling sensitive data or credentials.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), requirement for user interaction (UI:R), unchanged scope (S:U), high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N). The medium severity balances the serious confidentiality breach potential against the barrier of user interaction and the fact that only the local user's process memory is at risk, not system-wide or multi-user impacts.

Frequently asked questions