CVE-2026-13845: Chrome DOM Use-After-Free Vulnerability (CVSS 8.8)

Technical summary

CVE-2026-13845 is a use-after-free vulnerability (CWE-416) in Chrome's DOM implementation. The flaw occurs when the browser attempts to access DOM objects that have already been deallocated from memory. An attacker can craft an HTML page that manipulates the DOM in a way that triggers this condition, allowing code execution within the browser's sandbox context. The sandbox provides some containment, but execution within it still represents a significant security failure. The vulnerability affects Chrome on Windows, macOS, and Linux systems.

Business impact

This vulnerability poses a direct threat to any organization where employees browse the web with Chrome. Successful exploitation could result in arbitrary code execution within the browser sandbox, potentially leading to data exfiltration, credential theft, malware installation, or lateral movement to other systems. Organizations relying on Chrome as a primary browser face elevated risk until patching is completed. The low barrier to exploitation—requiring only user navigation to a malicious site—makes this a practical attack vector for targeted campaigns.

Affected systems

Google Chrome versions before 150.0.7871.47 are affected across all supported platforms: Windows, macOS, and Linux. The vulnerability also technically affects the underlying Linux kernel and macOS components that Chrome depends on, though the primary vulnerability resides in Chrome's DOM handling code. Any Chrome installation that has not been updated to version 150.0.7871.47 or later remains vulnerable.

Exploitability

This vulnerability has a CVSS score of 8.8 (HIGH) with a network attack vector, low complexity, and no privilege requirements. Critically, user interaction is required—the victim must visit a malicious webpage—but this is a practical constraint rather than a significant barrier. Attackers can distribute malicious links via email, social engineering, or watering-hole attacks targeting specific organizations. The fact that the vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog does not indicate low risk; it reflects current threat intelligence status and may change as disclosure widens. Exploit development is likely feasible given the well-understood nature of use-after-free bugs.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later. Chrome's automatic update mechanism should deliver this update, but verification is recommended. Users can manually check their version via Chrome menu > Help > About Google Chrome, which will automatically check for and apply updates. Organizations managing Chrome deployments should prioritize this update and verify completion across their fleet, particularly for users in sensitive roles or targeted industries.

Patch guidance

Deploy Chrome 150.0.7871.47 or later across your environment. For enterprise deployments, use Chrome's enterprise policy tools or your mobile device management (MDM) solution to enforce the update. Verify that auto-update is enabled and functional. If your organization uses Chrome extended support channel, confirm that your supported version includes this fix. Do not rely solely on user-initiated updates; implement centralized enforcement where possible. Test the update in a limited deployment first if your environment is risk-sensitive, though the patch addresses a critical security issue and should not introduce compatibility concerns.

Detection guidance

Monitor for indicators of attempted exploitation including unexpected DOM manipulation patterns, unusual JavaScript execution, or browser crash reports that correlate with user visits to untrusted sites. Endpoint detection and response (EDR) solutions should flag suspicious process behavior originating from Chrome child processes. Network-based detection is limited since the attack vector is a user visiting a webpage; focus detection efforts on post-exploitation behavior such as unexpected data exfiltration, credential access, or lateral movement attempts. Browser history logs and crash dumps may contain forensic evidence of exploitation attempts. Consider deploying browser isolation technology for high-risk users or workflows to contain potential exploitation impact.

Why prioritize this

This vulnerability merits immediate prioritization due to its combination of high CVSS score (8.8), practical exploitability requiring only user interaction, and the ubiquity of Chrome in modern computing environments. The use-after-free class of vulnerability is well-understood by attackers and frequently weaponized. Organizations should treat this as a critical patch deployment task and allocate resources to achieve rapid fleet-wide coverage. The absence from the KEV catalog should not delay action; proactive patching before active exploitation begins is the optimal risk posture.

Risk score, explained

The CVSS 8.8 HIGH score reflects: (1) network attack vector—no direct system access required; (2) low attack complexity—no special conditions needed beyond crafting a malicious webpage; (3) no privilege escalation required; (4) high impact across confidentiality, integrity, and availability (arbitrary code execution); (5) user interaction requirement (visiting a webpage), which is a practical constraint in targeted attacks but not an insurmountable barrier. The score appropriately reflects the severity of arbitrary code execution within the browser context, even if sandboxed.

Frequently asked questions