CVE-2026-13823: Chrome Glic Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-13823 is a use-after-free vulnerability (CWE-416) in the Glic component affecting Chrome versions prior to 150.0.7871.47. The vulnerability arises when Glic improperly manages memory references, allowing a compromised renderer process to access freed memory regions. By crafting a malicious HTML page, an attacker can trigger this memory corruption to escape the renderer sandbox—Chrome's critical isolation boundary. The Chromium security team rated this High severity due to the sandbox escape potential, though successful exploitation requires an initial renderer compromise.

Business impact

A successful exploit chain allows an attacker to elevate from a compromised renderer process to arbitrary code execution outside the sandbox, potentially compromising the entire system. For organizations, this means that renderer exploits (which are more commonly found and weaponized) can be chained with this vulnerability to achieve full system compromise, not merely tab-level isolation. This increases the threat level of existing or future renderer vulnerabilities discovered in the wild.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. Desktop and mobile Chrome installations running affected versions are at risk. Organizations using Chrome as their primary browser, particularly those in high-risk environments, should prioritize inventory and patching of their Chrome installations to 150.0.7871.47 or later.

Exploitability

Exploitation requires high complexity: an attacker must first compromise the renderer process (via a separate vulnerability or social engineering) and then deliver the malicious HTML page to trigger the use-after-free. The CVSS vector indicates user interaction is required, and the access is network-based. While the individual technical bar for triggering the memory corruption is moderate, the prerequisite renderer compromise limits real-world frequency. However, in targeted scenarios or exploit chains, this is a credible risk.

Remediation

Upgrade Google Chrome to version 150.0.7871.47 or later on all systems. Chrome's auto-update mechanism typically deploys patches within days; verify completion across your environment. No workarounds exist for this class of vulnerability—patching is the only mitigation. Consider enforcing Chrome version pinning and update policies to ensure timely deployment.

Patch guidance

Google Chrome auto-updates are the standard deployment mechanism. Navigate to Chrome menu > About Google Chrome to check current version and force an update if pending. For enterprise environments, use Chrome policies to manage rollout schedules and defer updates if needed (though deferral should be brief given the sandbox escape risk). Verify that version 150.0.7871.47 or later is deployed organization-wide within 72 hours of availability. Mobile Chrome (iOS and Android) will receive patches through their respective app stores.

Detection guidance

Monitor Chrome version inventory across your environment using endpoint tools or MDM solutions; flag any instances running versions prior to 150.0.7871.47. Detection of active exploitation would require monitoring for abnormal process behavior escaping the Chrome sandbox (e.g., Chrome spawning processes outside expected bounds, file system access anomalies, or network connections from Chrome's host process). EDR and behavioral monitoring tools should alert on such sandbox escapes. Additionally, monitor for HTML pages or scripts attempting to trigger Glic memory corruption patterns, though this is challenging without specific signatures.

Why prioritize this

Although not yet listed on CISA's KEV catalog, this vulnerability merits urgent prioritization because it enables sandbox escape—a critical security boundary in modern browsers. Sandbox escapes amplify the impact of renderer vulnerabilities, which are discovered regularly and sometimes weaponized. Organizations should treat this as P1: patch within days, not weeks. The combination of High CVSS, sandbox escape capability, and the likelihood of future renderer chains involving this flaw justifies aggressive remediation.

Risk score, explained

CVSS 8.3 (High) reflects the confluence of high confidentiality, integrity, and availability impact (sandbox escape grants system-level access), combined with network attack vector and requirement for user interaction. The High severity is appropriate because a compromised renderer can escape isolation, enabling full system compromise. Although exploitation requires a prior renderer compromise, the vulnerability's role in privilege escalation and sandbox escape justifies the score. The realistic risk in your environment depends on your renderer vulnerability exposure and user browsing practices.

Frequently asked questions