CVE-2026-13835: Critical Chrome XML Heap Corruption Vulnerability – Patch Now

Technical summary

CVE-2026-13835 arises from an inappropriate implementation in XML handling within Chrome's rendering engine. The root cause is a heap corruption vulnerability (CWE-122: Heap-based Buffer Overflow) triggered during the parsing or processing of specially crafted XML structures embedded in HTML documents. The flaw allows an unauthenticated remote attacker to write out-of-bounds data to the heap, bypassing memory protections and achieving arbitrary code execution in the context of the Chrome process. The attack surface is the web; no authentication or elevated privileges are required. Chromium rates this as High severity.

Business impact

Successful exploitation enables an attacker to execute arbitrary code within Chrome, giving them the same permissions as the browser process. In most cases, this permits theft of browsing data (passwords, cookies, session tokens, cached credentials), installation of persistent backdoors, or lateral movement to other systems on the network. Organizations where employees browse untrusted or compromised websites face direct exposure. Supply-chain scenarios—such as advertising network compromise or legitimate website defacement—can amplify reach. Delayed patching increases the window during which user devices remain vulnerable.

Affected systems

Google Chrome versions before 150.0.7871.47 are affected. This includes stable, extended stable, and beta releases below that version. Chrome's rapid auto-update mechanism means most users will receive the patch automatically; however, organizations with delayed update policies, offline environments, or managed deployments may have exposure for weeks. Chromebook users, enterprise Chrome deployments, and consumer Windows, macOS, and Linux installations all qualify as affected.

Exploitability

The attack requires a user to visit a malicious or compromised website—a realistic threat vector. No special browser configuration, plugins, or user actions beyond normal browsing are needed. The attack succeeds against default Chrome installations. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high impact (confidentiality, integrity, and availability all compromised) and low complexity. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog; however, the straightforward nature of the flaw and its critical impact make it an attractive target for weaponization, and defensive measures should assume active interest from threat actors.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. For users relying on automatic updates, the patch should deploy within days of release. Organizations managing Chrome through mobile device management (MDM), group policy, or enterprise channels should verify update deployment status. For offline or air-gapped environments, manual download and staged rollout of the patched version is necessary. No workaround exists; patching is the only effective mitigation.

Patch guidance

Verify the installed Chrome version by navigating to chrome://settings/help (which triggers the update check). The stable release version 150.0.7871.47 or later confirms the patch. For enterprise deployments, consult your MDM solution or Chrome policy management console to confirm update status across the fleet. Test patched browsers against internal web applications to detect any compatibility regressions before full rollout. Staged rollout to 10–20% of users initially is prudent. Document the patch date and version in your change management system.

Detection guidance

Monitor for users on Chrome versions older than 150.0.7871.47 using endpoint detection tools, browser inventory queries, or MDM reporting. Examine web proxy or DNS logs for connections to known malicious domains, defaced legitimate sites, or adversary infrastructure hosting exploit payloads. Look for abnormal Chrome process behavior (unexpected child processes, network connections, or file modifications) following high-risk browsing sessions. Correlate Chrome crashes with web traffic to identify potential exploit attempts. EDR solutions can alert on heap corruption signatures or suspicious Chrome child process spawning.

Why prioritize this

This vulnerability merits immediate attention despite lacking KEV status. The CVSS score of 8.8 reflects critical impact: unauthenticated remote code execution requiring only user interaction. Chrome's ubiquity as both a consumer and enterprise browser means exposed users are numerous. The flaw is in core XML parsing, a fundamental component touching many websites. The absence of public exploit code is no guarantee of safety—the simplicity of the attack vector makes weaponization likely. Organizations should treat this as a same-day or next-day priority.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) is driven by: network-accessible attack surface (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), but user interaction needed (UI:R). The impact vector is maximal—confidentiality, integrity, and availability are all fully compromised (C:H/I:H/A:H). The unchanged scope (S:U) reflects that the impact is confined to the Chrome process and user data, not the underlying OS or network. This score appropriately reflects the critical nature of remote code execution in a widely used application.

Frequently asked questions