CVE-2026-13820: Chrome Skia Out-of-Bounds Read on macOS – Data Leak Vulnerability

Technical summary

CVE-2026-13820 is an out-of-bounds read vulnerability in Skia (Google Chrome's rendering engine) on macOS. The flaw allows an attacker with prior renderer process compromise to leak cross-origin data through crafted HTML. CWE-125 (out-of-bounds read) describes a memory access violation where code reads data outside the intended buffer, potentially exposing sensitive information. The vulnerability is triggered when rendering specially crafted HTML, meaning no user interaction beyond visiting a malicious page is required. Chrome version 150.0.7871.47 and later patch this issue.

Business impact

While the immediate exposure is limited to users whose renderer process is already compromised, this vulnerability compounds the risk of initial compromise. An attacker gaining renderer access through a separate code execution flaw or drive-by download could then use this out-of-bounds read to exfiltrate authentication tokens, session cookies, or data from other sites in memory. For organizations with security-sensitive workflows in Chrome, this increases the window of damage following a renderer compromise. Incident response becomes more complex if data leakage must be audited across multiple origins.

Affected systems

Google Chrome on macOS is affected. The vulnerability is specific to macOS and does not apply to Chrome on Windows, Linux, or other platforms. All Chrome versions prior to 150.0.7871.47 on macOS are vulnerable. This affects both standalone Chrome installations and Chrome bundled with other Apple software. Users running Chrome 150.0.7871.47 or later are protected.

Exploitability

Exploitability is constrained but not trivial. An attacker must first compromise Chrome's renderer process—typically by tricking a user into visiting a site with a separate renderer code execution vulnerability or social engineering a download. Once renderer access is established, the attacker can serve HTML that triggers the out-of-bounds read with no additional user interaction. The attack does not require special privileges, network access is standard HTTP/HTTPS, and relies only on user interaction to visit a webpage. The CVSS score of 6.5 (medium severity) reflects the prerequisite of prior compromise; the vulnerability is not a standalone entry point but an amplifier of existing renderer compromise.

Remediation

Update Google Chrome on macOS to version 150.0.7871.47 or later. This is a straightforward patch that users can initiate through Chrome's built-in update mechanism (Settings > About Chrome > Check for update). Organizations managing Chrome fleet-wide should ensure macOS deployment policies mandate this version or later. No workarounds or configuration changes mitigate the vulnerability short of updating.

Patch guidance

Deploy Chrome 150.0.7871.47 or later on all macOS systems using Chrome. Verify deployment by checking the browser version in Chrome's settings. Organizations using mobile device management (MDM) or enterprise deployment tools should set minimum version policies to 150.0.7871.47. Test the update in a non-production environment first if the organization has dependencies on Chrome extensions or enterprise integrations, though this patch is low-risk for most deployments.

Detection guidance

Endpoint Detection and Response (EDR) tools should monitor for signs of renderer process compromise preceding exploitation of this flaw: unexpected child processes spawned by Chrome, suspicious memory access patterns, or abnormal network connections initiated by Chrome. Log Chrome version across the fleet to identify systems below 150.0.7871.47. Web proxies and network monitoring can note anomalies in outbound data from Chrome sessions, though the data exfiltration would likely be small and encoded. Treat any confirmed renderer compromise as a signal to assume this vulnerability may have been chained in the attack.

Why prioritize this

This vulnerability ranks as medium priority (CVSS 6.5) and should be scheduled for near-term patching, typically within 30 days. While it requires prior renderer compromise and thus is not a self-contained attack vector, it significantly amplifies the damage of existing Chrome exploits. Organizations with high-value users (executives, developers, security staff) running Chrome on macOS should prioritize this update sooner, as these users are higher-value targets for initial compromise. Given that the vulnerability was published in June 2026 and a patch is available, delay increases organizational risk.

Risk score, explained

The CVSS 3.1 score of 6.5 (medium) reflects: Network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), and user interaction required (UI:R) to visit the malicious page—but the prerequisite of prior renderer compromise is the key limiting factor. The consequence is high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). The 'medium' severity bucket appropriately positions this as a serious but not critical vulnerability; it is not an independent infection vector but a co-exploitation risk that multiplies the damage of other renderer flaws.

Frequently asked questions