CVE-2026-13855: Chrome Ozone Use-After-Free RCE on Linux

Technical summary

CVE-2026-13855 is a use-after-free condition (CWE-416) in Chrome's Ozone display server abstraction layer affecting Linux deployments. The flaw occurs when freed memory is dereferenced during specific UI event sequences, allowing an attacker to achieve code execution within the browser's rendering process. Google classified this as High severity. The vulnerability exists in Chrome versions prior to 150.0.7871.47 on Linux; Windows and macOS appear unaffected based on the platform-specific nature of Ozone on Linux.

Business impact

Compromise of a user's Chrome browser process grants attackers access to all data within that browser context—cached credentials, session tokens, autofilled data, and locally stored secrets. An attacker could exfiltrate sensitive business information, inject malware, or establish persistence. For organizations where employees use Chrome for business, this represents a direct threat to confidentiality and integrity. The requirement for user interaction (clicking a link or visiting a site) lowers the barrier to weaponization, especially through watering-hole attacks or targeted phishing.

Affected systems

Google Chrome on Linux prior to version 150.0.7871.47 is the primary affected platform. The Ozone subsystem is specific to Linux, so users on Windows and macOS running earlier Chrome versions are not vulnerable to this particular flaw. The Linux kernel itself is listed as a vendor/product but is not the vulnerable component; the vulnerability resides entirely in Chrome's Ozone layer.

Exploitability

Exploitation requires crafting a malicious HTML page and convincing a user to visit it while performing specific UI interactions (such as mouse or keyboard gestures). This is a moderate barrier compared to zero-click exploits but aligns with standard web-based attack patterns. The CVSS score of 7.5 reflects High severity with network attack vector and user interaction requirement. No public exploit has been added to CISA's KEV catalog, suggesting active exploitation in the wild is not yet documented, though this does not guarantee the vulnerability remains unexploited.

Remediation

Users and administrators should update Google Chrome to version 150.0.7871.47 or later on Linux systems. Chrome's auto-update mechanism typically deploys patches within days, but manual verification is recommended for managed environments. No workarounds exist; patching is the only mitigation. Organizations should verify patch deployment across all Linux systems running Chrome, including developer machines, testing environments, and user endpoints.

Patch guidance

Update Google Chrome to 150.0.7871.47 or later. On Linux, this is typically accomplished via the system package manager (apt, yum, dnf) or Chrome's built-in update mechanism. Verify the version by navigating to chrome://version in the address bar. For managed deployments, use enterprise policies or configuration management tools to enforce the patch. Verify the patched version in your environment before closing the incident.

Detection guidance

Monitor for Chrome crashes or unexpected termination on Linux systems, as use-after-free vulnerabilities often result in memory protection violations. Network-based detection is limited; endpoint detection should focus on unexpected child processes spawned by Chrome or unusual system calls. Log successful Chrome updates to version 150.0.7871.47 or later to confirm patch status. Consider blocking known malicious domains or phishing campaigns targeting Chrome users if threat intelligence identifies exploitation attempts.

Why prioritize this

This vulnerability merits immediate patching priority due to its High CVSS score, user interaction requirement (realistic attack vector), and the Ozone subsystem's role in display handling—a critical path in browser operation. Although not yet in CISA's KEV catalog, the specificity and severity suggest targeted exploitation is plausible. Organizations running Chrome on Linux for business purposes should prioritize this update within their standard patch cycles (typically 24–72 hours).

Risk score, explained

The CVSS 3.1 score of 7.5 (High) is driven by: Network attack vector (user visits a malicious page), High confidentiality/integrity/availability impact (full code execution within browser), and User Interaction required (specific UI gestures). The Attack Complexity is High, reflecting the need for crafted HTML and user cooperation. This score aligns with Chromium's High severity rating and reflects the practical risk of browser-based code execution without requiring system-level privileges.

Frequently asked questions