CVE-2026-13817 Chrome Sandbox Escape: Patch Now (v150.0.7871.47)

Technical summary

CVE-2026-13817 is an input validation defect (CWE-20) in the Glic component of Google Chrome versions prior to 150.0.7871.47. The vulnerability arises from insufficient sanitization of untrusted input, enabling a sandbox escape. The attack vector is network-based and requires user interaction (visiting a crafted web page). No authentication is necessary. The flaw permits complete compromise of confidentiality, integrity, and availability within the Chrome process context and potentially the host system beyond it.

Business impact

Sandbox escape vulnerabilities in widely-deployed browsers represent significant business risk. An organization whose employees browse the web using vulnerable Chrome instances faces potential system compromise without additional malware or lateral movement requirements. This could lead to data exfiltration, credential theft, malware installation, and operational disruption. Given Chrome's ubiquity in both enterprise and consumer environments, the attack surface is broad and the barrier to exploitation is low.

Affected systems

All installations of Google Chrome versions prior to 150.0.7871.47 are affected. This includes Windows, macOS, and Linux deployments. Users on older or unmanaged Chrome instances—particularly in organizations with delayed patch cycles—face heightened risk. Extended-support releases and enterprise-locked Chrome instances should be prioritized for immediate update verification.

Exploitability

The attack requires only that a user visit a malicious HTML page; no special user privileges or system configuration is required. The barrier to weaponization is low: a threat actor needs only to host a crafted page or inject it into legitimate sites via compromised ads, compromised content delivery networks, or social engineering. While active exploitation in the wild is not confirmed by the KEV catalog, the combination of low complexity and high impact makes this an attractive target for both opportunistic and targeted campaigns.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism should push patches automatically, but manual verification is advisable for critical or air-gapped systems. Organizations managing Chrome via enterprise policies should verify that their deployment infrastructure propagates the patch to all endpoints without delay. Rollback is not necessary if patching is completed promptly.

Patch guidance

Verify that all Chrome instances have auto-update enabled and have rebooted to apply the patch. For enterprise deployments, consult Google's Chrome release notes and your MDM/configuration management platform to confirm version 150.0.7871.47 or later is deployed across your fleet. Test patching in a non-production environment first if your organization requires change control. Confirm version via Chrome Settings > About Chrome; the browser will display both current and target versions during update.

Detection guidance

Monitor for browser process crashes or unexpected child processes spawned from Chrome—these may indicate exploitation attempts. Check network logs for requests to suspicious or malware-hosting domains that might serve crafted HTML payloads. Endpoint detection and response (EDR) tools should be configured to alert on Chrome sandbox escape indicators such as unusual system calls or privilege escalation attempts from the Chrome process. Web content filtering and DNS sinkhole techniques can help block known malicious domains before payload delivery.

Why prioritize this

This vulnerability merits urgent priority due to its high CVSS score (8.8), sandbox escape capability, low complexity of exploitation, and broad user base. The requirement for only user interaction (visiting a web page) means attackers can reach victims at scale. Organizations should treat this as critical and aim to patch all endpoints within 48 hours. The fact that it is not yet listed in the KEV catalog does not reduce urgency; early patching provides a window of advantage before active exploitation becomes widespread.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the following: network-based attack vector with no privilege or authentication requirements; low attack complexity; user interaction needed (visiting a page); sandbox escape enabling complete system compromise (confidentiality, integrity, availability all affected); and no scope limitation once the sandbox is broken. The High severity rating is appropriate given the potential for full system takeover following successful exploitation.

Frequently asked questions