CVE-2026-13828: Chrome Memory Disclosure Vulnerability – Patch 150.0.7871.47

Technical summary

CVE-2026-13828 is a memory disclosure vulnerability in Google Chrome's Enterprise implementation caused by inappropriate handling of process memory access controls. An unauthenticated remote attacker can craft a malicious HTML page that, when viewed by a user, reads sensitive data from the Chrome process's memory space. The vulnerability is classified as CWE-284 (Improper Access Control) and carries a CVSS 3.1 score of 6.5 (Medium severity). The attack vector is network-based with low attack complexity; no special conditions or privileges are required beyond user interaction. Availability and integrity of the system are not impacted—only confidentiality is compromised. Google rates the underlying Chromium issue as High severity despite the CVSS Medium rating, suggesting the practical exploitability or sensitivity of accessible data warrants close attention.

Business impact

Data leakage from Chrome process memory could expose sensitive information such as authentication tokens, cached credentials, session data, encryption keys, or user-entered form content. In enterprise environments where Chrome is used for SaaS applications, email, or internal portals, this risk is amplified. Attackers need only to trick a user into visiting a malicious site—no elaborate social engineering is required beyond a link or embedded content. For organizations with strict data-handling requirements (finance, healthcare, government), even a medium-severity memory leak may trigger compliance concerns. The Enterprise-specific implementation suggests this may affect corporate deployments more directly than consumer versions.

Affected systems

Google Chrome browser versions prior to 150.0.7871.47 on Microsoft Windows, Apple macOS, and Linux are vulnerable. The vulnerability is specific to Chrome's Enterprise implementation, though the exact scope of that designation (managed devices, specific policies, or all Enterprise users) is not detailed in the advisory. Since Chrome auto-updates by default, most users should reach patched versions automatically; however, organizations with delayed or managed update rollouts remain at risk until they explicitly deploy version 150.0.7871.47 or later.

Exploitability

The attack requires user interaction—a victim must visit a malicious webpage or click a link to trigger the memory read. No exploit code execution, privilege escalation, or system compromise is needed. From an attacker's perspective, the barrier to exploitation is low: any hosting of a crafted HTML page combined with basic phishing, watering-hole tactics, or compromised ad networks could deliver the payload. However, the attacker cannot control *which* memory is read with surgical precision, meaning the value of the extracted data depends on what processes and data happen to be in memory at the time of the attack. This uncertainty may limit reliability for targeted attacks but does not prevent mass exploitation.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome users on auto-update will receive this patch automatically; verify your installed version in Settings > About > Google Chrome. For managed enterprise deployments, force a browser update or use Chrome Enterprise policies to enforce the minimum version. No workarounds exist; patching is the only mitigation. If users must remain on older Chrome versions temporarily, restrict their browsing to trusted internal sites and implement network-level filtering (proxy, DNS blocking) to prevent visits to untrusted external sites.

Patch guidance

Google Chrome version 150.0.7871.47 contains the fix. Administrators should validate the patch is applied by checking installed versions across their fleet. For Windows and macOS, Chrome typically auto-updates on restart; for Linux, update via your package manager (apt, yum, pacman, etc.) or manually download from google.com/chrome. Verify the patched version is running before considering the vulnerability closed. Test that critical enterprise web applications continue to function normally post-update, as browser version changes occasionally affect compatibility with legacy internal tools.

Detection guidance

Monitor for visits to suspicious or attacker-controlled domains in proxy or DNS logs. Endpoint detection and response (EDR) tools may flag unusual memory access patterns within Chrome processes, though this is inherently difficult to detect without deep visibility into process internals. Web application firewall (WAF) rules targeting known exploit delivery mechanisms (iframe injection, JavaScript-based memory reads, etc.) can provide some protection. Prioritize monitoring users in high-risk roles (finance, HR, legal, leadership) or those accessing sensitive systems. Browser telemetry (if enabled in your environment) may reveal abnormal memory access—coordinate with Chrome Enterprise monitoring tools. Until patched, assume that any visit to an untrusted website carries risk and educate users accordingly.

Why prioritize this

This vulnerability deserves high priority despite a Medium CVSS score due to its low attack friction (user interaction, no privilege required), potentially sensitive nature of browser memory contents (tokens, credentials, keys), and broad deployment of Chrome across enterprises. Google's High severity rating underscores the practical concern. The lack of a KEV listing suggests active exploitation has not yet been observed in the wild, but the simplicity of the attack may lead to rapid weaponization. For organizations handling sensitive data or relying on Chrome for access to high-value systems, patching within 48–72 hours is advisable. Smaller organizations or those with slower update cycles should target patch completion within two weeks.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects the combination of network accessibility (AV:N, low barrier), low attack complexity (AC:L, no special conditions), no privilege requirements (PR:N), and necessary user interaction (UI:R). The key driver of the Medium score is that only confidentiality is affected (C:H) with no impact to integrity or availability. However, the *nature* of the compromised data—browser process memory potentially containing authentication material—elevates practical risk beyond the numerical score. Organizations should not dismiss this as low-priority simply because CVSS is Medium; context matters, and in a Chrome-heavy enterprise, the data exposure risk is substantial.

Frequently asked questions