CVE-2026-13811: Chrome IME Use-After-Free RCE Sandbox Escape

Technical summary

CVE-2026-13811 is a use-after-free vulnerability (CWE-416) in Chrome's IME subsystem that allows remote code execution within the Chrome sandbox. The flaw exists in versions prior to 150.0.7871.47 and can be triggered via a specially crafted HTML page delivered over the network. While sandboxed, successful exploitation could allow an attacker to break out of the sandbox with additional effort or chain the vulnerability with other flaws. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network-accessible attack surface, low complexity, requirement for user interaction, and high impact to confidentiality, integrity, and availability.

Business impact

Organizations relying on Chrome as a primary browser face risk of data exfiltration, system compromise, and potential lateral movement if an attacker successfully exploits this vulnerability. The combination of high severity rating and active exploitation potential makes this a material threat to endpoints. Users who browse untrusted content or receive phishing emails with malicious links are particularly vulnerable. The sandbox mitigation reduces—but does not eliminate—the severity of a successful exploit.

Affected systems

Google Chrome prior to version 150.0.7871.47 is directly affected. While the source data lists macOS, Linux, and Windows platforms, these reflect the operating systems on which Chrome runs rather than OS-level vulnerabilities. All Chrome installations on Windows, macOS, and Linux that have not been updated to 150.0.7871.47 or later require attention.

Exploitability

Exploitation is feasible and requires only that a user visit a malicious webpage—no special configuration, authentication, or user privileges are needed. The low complexity and network accessibility make this vulnerability attractive to attackers. However, the reliance on user interaction (clicking a link or visiting a site) provides a window for awareness campaigns and email filtering. The absence of KEV designation does not indicate low exploitability; it reflects current threat intelligence as of the published date.

Remediation

Immediate patching to Chrome version 150.0.7871.47 or later is the primary mitigation. Organizations should verify Chrome auto-update settings are enabled; most deployments update automatically within hours of release. For locked-down environments, administrators should push the patch through their deployment tools. Until patching is complete, users should avoid visiting untrusted websites and exercise caution with email links and attachments from unknown senders.

Patch guidance

Apply Chrome version 150.0.7871.47 or later as soon as possible. For enterprise deployments: verify that Chrome auto-update is active (default for most installations), or use your configuration management tooling to force the update across your fleet. Check Chrome's release notes and Chromium security advisories for any additional context or rollout recommendations. No downtime or complex prerequisite steps should be required—the patch is straightforward to deploy.

Detection guidance

Monitor Chrome version inventory across your environment to identify systems running versions prior to 150.0.7871.47. Web proxies and email security gateways can log access to known malicious domains associated with exploitation attempts. Endpoint detection and response (EDR) tools may flag unusual process execution originating from Chrome child processes. Network intrusion detection can identify command-and-control traffic from compromised endpoints. Consider hunting for abnormal IME-related process behavior or memory corruption indicators on systems where users browse high-risk content.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.8), lack of privilege requirements, network accessibility, and the critical nature of Chrome as an attack surface in most organizations. While sandboxing provides defense-in-depth, the ability to execute arbitrary code in the sandbox is a significant stepping stone to full system compromise. The relative ease of exploitation (low complexity, user interaction only) and the fact that it affects a widely deployed application elevate risk to urgent status.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a remote, unauthenticated attack vector with low complexity, combined with high impact to confidentiality, integrity, and availability. The user interaction requirement prevents a 9.x score, but the sandbox execution context does not lower the base score—it is a defense mechanism, not a scope limitation. Organizations should treat this as a critical patch for any user-facing endpoints, particularly those with internet access.

Frequently asked questions