CVE-2026-13830: Critical Use-After-Free in Chrome Chromoting on Linux

Technical summary

CVE-2026-13830 is a use-after-free vulnerability (CWE-416) in the Chromoting component of Google Chrome on Linux. The vulnerability exists prior to version 150.0.7871.47 and permits remote code execution via crafted network packets. Chromoting is Chrome's remote desktop feature; the flaw allows an adjacent network attacker to exploit a memory safety issue by referencing memory that has already been freed, leading to arbitrary code execution in the context of the Chrome process. The Chromium project has assigned this a High security severity rating.

Business impact

Successful exploitation enables an attacker positioned on the same network segment to gain full code execution on Linux systems running vulnerable Chrome versions. This could lead to data theft, system compromise, lateral movement to other network resources, or deployment of malware. Organizations relying on Chrome for remote administration or sensitive workflows face elevated risk. The attack requires network adjacency but no user click-through, making it a significant concern in environments where users may be on shared networks (corporate guest networks, cloud infrastructure, etc.).

Affected systems

Google Chrome on Linux systems running versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the Chromoting remote desktop feature, so systems without Chromoting enabled or those running Chrome on other operating systems are not affected by this particular flaw. Organizations should inventory Chrome deployments on Linux infrastructure to determine exposure scope.

Exploitability

The vulnerability has a CVSS 3.1 score of 8.8 (High), reflecting a network-adjacent attack vector with low complexity and no authentication or user interaction required. The attacker must be on the same network segment to deliver malicious traffic, but once positioned, exploitation is straightforward. This has not been added to the KEV catalog, indicating no evidence of active in-the-wild exploitation at the time of publication, though this should be monitored as threats often emerge after vulnerability disclosure.

Remediation

Update Google Chrome on all Linux systems to version 150.0.7871.47 or later. This patch addresses the use-after-free condition in Chromoting. Organizations should prioritize patching based on the prevalence of Chrome on Linux in their environment and the network accessibility of affected systems. Users who do not actively use Chromoting may consider disabling the feature as an interim measure, though patching is the definitive remediation.

Patch guidance

Google Chrome typically auto-updates, but administrators should verify that Linux deployments have applied version 150.0.7871.47 or later. Consult Google's official Chrome release notes and Chromium security advisories to confirm patch availability for your Linux distribution. Enterprise deployments should test the patch in a staging environment before broad rollout to ensure compatibility with dependent workflows. Verify the update has been applied by checking chrome://version in the browser.

Detection guidance

Monitor for unexpected Chromoting network traffic or connection attempts, particularly from external or guest network segments. Endpoint detection and response (EDR) tools should flag any Chrome process spawning child processes or accessing unusual memory regions post-update, which could indicate exploitation attempts. Log authentication to Chrome remote desktop features and alert on failed Chromoting sessions from unknown sources. Vulnerability scanners should identify Chrome versions prior to 150.0.7871.47 on Linux hosts as part of routine asset discovery.

Why prioritize this

This vulnerability merits prompt attention due to its high CVSS score (8.8), lack of user interaction requirement, and direct code execution capability. The network-adjacent attack vector limits immediate exposure in fully air-gapped environments, but any Linux system with Chrome exposed to untrusted networks should be treated as high-priority. The absence of KEV status and public exploit code does not diminish the urgency—use-after-free bugs are well-understood by sophisticated actors, and exploitation tooling can be developed quickly once the flaw is public.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the confluence of high confidentiality, integrity, and availability impact (all marked High) combined with an adjacent network attack vector and low attack complexity. The lack of privilege requirements or user interaction increases the score. The primary mitigating factor is the network-adjacency requirement; however, in modern enterprise and cloud environments where systems share network segments with potentially hostile actors, this is a modest constraint. Organizations with Linux Chrome deployments on shared networks face substantial risk.

Frequently asked questions