CVE-2026-13825: Critical Chrome Heap Corruption via Uninitialized Memory in Dawn Graphics Engine

Technical summary

CVE-2026-13825 is an uninitialized variable vulnerability (CWE-457) in the Dawn graphics API wrapper used by Chromium-based browsers. When Dawn processes certain rendering operations, it fails to initialize heap-allocated memory before using it, creating a use-after-free or out-of-bounds condition. An attacker can craft HTML with specific WebGL or similar graphics directives to trigger this code path. The Chromium security team rates this as High severity; the CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact with low attack complexity and no privilege requirement, moderated only by the requirement for user interaction.

Business impact

Chrome is the dominant browser globally, and this vulnerability affects confidentiality, integrity, and availability. An attacker could steal sensitive data (e.g., login credentials, site data), modify content displayed to the user, or crash the browser. Large organizations with BYOD policies or those unable to immediately patch face increased risk of data theft and user disruption. The attack surface is broad: any website, advertisement, or embedded content can deliver the malicious page.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The vendor and product list indicates impact extends to platforms running Chrome (Windows, macOS, Linux), meaning the underlying OS alone is not the vulnerability vector, but rather the Chrome installation on those systems. Organizations should verify their Chrome deployment versions against the patched release number.

Exploitability

This vulnerability is network-based and requires no prior authentication or special privileges. Exploitation only requires a user to visit a crafted webpage, which can be delivered through watering-hole attacks, malvertising, or direct social engineering. No special browser configuration is needed. The barrier to weaponization is moderate: an attacker must understand the specific graphics code path and heap layout to reliably trigger corruption, but public research into similar memory safety bugs suggests this is within reach of skilled threat actors. As of the advisory date, no public exploit code is known, and the vulnerability is not on CISA's Known Exploited Vulnerabilities list.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Users on Windows, macOS, and Linux should enable automatic updates or manually check for the latest version via Help > About Google Chrome, which will automatically download and prompt for restart. Organizations managing Chrome deployments should use enterprise update policies to enforce patching. No workarounds short of disabling graphics acceleration are practical for end users.

Patch guidance

Verify the exact patch version from the official Chrome release notes (support.google.com/chrome/answer/95414). Chrome auto-updates by default for personal users; business deployments using Windows Group Policy or similar mechanisms should update the required version policy to enforce 150.0.7871.47 minimum. Test the patch in a non-production environment first if you manage custom Chrome configurations or extensions. Rollback is typically not necessary as patches in the 150 series are forward-compatible.

Detection guidance

Monitor for Chrome crash dumps on endpoints, particularly those correlated with graphics-intensive websites or WebGL content. Network-based detection is limited since the malicious HTML itself may be obfuscated; however, organizations using DNS filtering or web proxies can flag suspicious graphics-heavy domains that have not been previously accessed. Endpoint detection and response (EDR) tools should alert on Chrome process crashes with abnormal exit codes or memory faults. Track Chrome version compliance across your fleet using mobile device management (MDM) or inventory tools.

Why prioritize this

This is a high-priority patch for any organization with Chrome deployments. The combination of high CVSS score, broad attack surface (any website), ease of exploitation (user click), and lack of mitigating controls makes this critical for timely patching. Threat actors do not yet appear to be weaponizing this at scale, giving organizations a window to patch before active exploitation becomes routine. Users of Chromebook fleets, corporate devices, and kiosk environments should prioritize deployment within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 8.8 (High) reflects: (1) Network attack vector with no privilege escalation; (2) Low attack complexity—the malicious HTML does not require targeting a specific Chrome version or configuration; (3) User interaction required—the target must visit the page; (4) High confidentiality, integrity, and availability impact once triggered, as memory corruption can leak data, modify behavior, or crash the process. The score would be Critical (9.0+) if user interaction were not required or if it affected a lower-level OS component, but in the context of a browser sandbox, High is appropriate.

Frequently asked questions