CVE-2026-13833: Chrome ANGLE Memory Leak on macOS – Patch Now

Technical summary

CVE-2026-13833 stems from uninitialized memory use in ANGLE (Almost Native Graphics Layer Engine), Chrome's cross-platform graphics abstraction layer. When rendering graphics on macOS, Chrome may fail to properly initialize GPU memory structures before use, leaving stale data from previous operations accessible. An attacker can construct a webpage that manipulates WebGL or similar graphics APIs to read uninitialized memory, exfiltrating data that would normally be isolated by browser sandbox boundaries. The flaw is classified as CWE-457 (Use of Uninitialized Variable). Chromium assigned this a High security severity designation.

Business impact

For organizations, this vulnerability primarily threatens user privacy and corporate data confidentiality. Employees accessing internal web applications or SaaS platforms on macOS via Chrome could leak authentication tokens, session identifiers, or confidential document snippets if an attacker controls a visited webpage. The risk is elevated in environments where users browse untrusted or compromised sites. Incident response teams should assume any macOS Chrome user on affected versions may have had sensitive browser state exposed during visits to malicious pages.

Affected systems

Google Chrome on Apple macOS prior to version 150.0.7871.47 is affected. This impacts all macOS users (Intel and Apple Silicon) running Chrome versions 149 and earlier. Desktop Chrome on Windows and Linux are not impacted by this specific vulnerability, nor are mobile variants (Chrome Mobile, Chrome for iOS). macOS system security does not mitigate this issue—it resides within Chrome's rendering engine.

Exploitability

Exploitation requires only that a user visit an attacker-controlled webpage; no additional client-side exploitation techniques or user interaction beyond clicking a link is necessary. The attack surface is broad (any webpage an employee visits could be compromised or malicious), but the attacker cannot trigger execution of arbitrary code or escalate privileges beyond the current browser context. The vulnerability earns a CVSS score of 6.5 (Medium severity) reflecting high confidentiality impact offset by network delivery and user-interaction requirements inherent to web browsing.

Remediation

Update Chrome on macOS to version 150.0.7871.47 or later immediately. Google released this patch on June 30, 2026. For managed environments, deploy updates via Chrome Enterprise policy (AutoUpdate setting) or Mobile Device Management. No workarounds exist short of disabling graphics acceleration, which is impractical and degrades performance. Organizations relying on Chrome should prioritize this patch over routine scheduled updates.

Patch guidance

Verify your current Chrome version by navigating to Chrome menu > About Google Chrome, which will display your version number and automatically begin downloading the latest build. On macOS, allow the installation to complete and relaunch Chrome when prompted. In enterprise settings, use the 'Update policy' configurations available in Chrome Admin Console to enforce deployment of version 150.0.7871.47 or later to all managed devices. Test the patch in a controlled pilot group before organization-wide rollout to confirm no application compatibility issues. Re-check the Chromium security advisory for any late-stage CVEs that might affect your chosen version.

Detection guidance

Monitor Chrome version inventory across your macOS fleet using MDM tools, crowdstrike sensors, or browser telemetry collection (if available). Flag any devices running version 149 or earlier for immediate intervention. Web proxy or DNS logs will not reliably detect exploitation; focus on deployment and compliance verification. If you suspect a user visited a malicious site, examine browser history timestamps, local cached files, and any unusual network activity correlating to visit times, though memory-based exfiltration may leave limited forensic traces.

Why prioritize this

Although CVSS severity is Medium, the practical risk is elevated because: (1) exploitation is trivial and requires no user sophistication, (2) macOS Chrome represents a large percentage of enterprise browsers in tech-forward organizations, (3) the data at risk includes session tokens and authentication credentials that directly enable follow-on attacks, and (4) no workarounds exist. Organizations should treat this as a near-critical priority patch for macOS users.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects high confidentiality impact (C:H) balanced against network-based attack delivery and user interaction requirements. However, the presence of uninitialized memory read vulnerabilities in browser engines is historically prone to in-the-wild exploitation and privilege escalation in practice. The 'not yet in KEV catalog' status should not reduce your priority; early patching after release is your strongest defense.

Frequently asked questions