CVE-2026-13814: Use-After-Free in Google Chrome Prior to 150.0.7871.47

Technical summary

CVE-2026-13814 is a use-after-free (CWE-416) vulnerability occurring in Chrome's Views subsystem. The flaw arises when memory that has been freed is accessed again, potentially corrupting the heap and allowing arbitrary code execution. The vulnerability requires user interaction—specifically, engagement with particular UI gestures in response to a crafted HTML payload—making it a user-assisted attack vector. Chromium project classified this as High severity due to the scope of impact and the direct path to memory corruption.

Business impact

Successful exploitation could result in unauthorized code execution in the browser context, potentially leading to credential theft, malware installation, or lateral movement into internal networks if the victim is an employee. The requirement for user interaction reduces mass-exploitation risk but increases targeted phishing and watering-hole attack scenarios. Organizations with high-value users (executives, developers, researchers) face elevated risk.

Affected systems

All Google Chrome installations version 149.0.7871.46 and earlier are vulnerable. This includes Chrome on Windows, macOS, and Linux. The vulnerability does not affect Chromium-based browsers built from older source trees unless they incorporate the vulnerable code path. Chrome's automatic update mechanism means unpatched systems are at immediate risk until users update or administrators enforce deployment of version 150.0.7871.47 or later.

Exploitability

While the vulnerability requires user interaction (UI gestures), the bar for triggering it is not exceptionally high—a user visiting a compromised website or clicking a malicious link could execute the necessary gestures unknowingly or through social engineering. However, it is not wormable and does not spread automatically. The CVSS score of 7.5 (High) reflects high impact (confidentiality, integrity, availability all affected) tempered by the AC:H (high attack complexity) and UI:R (user interaction required) factors. No public exploits or KEV status indicate active exploitation as of the advisory date.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update feature will deploy the patch automatically on most systems, but verify completion via Chrome menu > About Google Chrome. For managed environments, deploy via enterprise policy tools or manual distribution. No workarounds are available; patching is the only remediation.

Patch guidance

Verify your Chrome version by navigating to chrome://settings/help. If the version is 149.0.7871.46 or lower, initiate an update immediately—Chrome will prompt automatically. In enterprise environments, use Chrome enterprise policy (chromeApps/pinned apps or update settings) to enforce deployment of 150.0.7871.47. Test the patch in a staging environment if you have custom extensions or web applications; use-after-free fixes occasionally affect extension behavior, though no such issues are reported for this CVE.

Detection guidance

Monitor for unexpected Chrome crashes or memory violations in endpoint logs, particularly correlated with visits to untrusted websites or unusual UI activity in Chrome. YARA or process memory scanning tools can identify heap corruption signatures post-exploitation. In a SOC, flag any alerts from EDR solutions indicating abnormal Chrome process behavior (heap corruption, code injection) as potential exploitation attempts. Network-level detection is limited since the payload is HTML; focus detection on post-exploitation indicators (credential access, file exfiltration, process spawning) rather than the initial compromise.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, direct path to code execution, and broad user base (Chrome is the dominant browser globally). The user-interaction requirement reduces mass-exploitation risk but increases the threat to organizations where social engineering is common. Priority should be HIGH for organizations with users in high-value roles or frequent interaction with external/untrusted content; MEDIUM for general corporate environments with controlled browsing policies.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects the combination of remote attack vector (AV:N), high attack complexity (AC:H due to the specific UI gestures required), no privilege requirement (PR:N), and required user interaction (UI:R). The scope is unchanged (S:U), and all impact metrics are high (C:H, I:H, A:H) because successful exploitation allows code execution with full process privileges. This places it in the HIGH severity band, appropriate for a memory corruption flaw in a widely-used application.

Frequently asked questions