CVE-2026-13873: Chrome Layout Out-of-Bounds Read Allows Memory Data Disclosure

Technical summary

CVE-2026-13873 is an out-of-bounds read vulnerability in Chrome's Layout subsystem. The flaw permits a remote, unauthenticated attacker to craft HTML that triggers an illegal memory access, reading data beyond intended buffer boundaries. The vulnerability is classified as CWE-125 (out-of-bounds read) and CWE-787 (out-of-bounds write), suggesting the Layout engine may fail to validate memory access boundaries during rendering operations. The CVSS 3.1 score of 6.5 reflects high confidentiality impact with no integrity or availability risk, requiring user interaction (visiting the malicious page) but no elevated privileges.

Business impact

Information disclosure poses moderate business risk, particularly for users handling sensitive data in browser sessions (credentials, financial information, proprietary details). Unlike memory corruption flaws that enable code execution, this vulnerability isolates confidentiality breach, but the barrier to exploitation is low—any malicious webpage can attempt the attack. Organizations should prioritize patching workstations, especially those used for sensitive work or handling classified materials, to prevent data leakage.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The affected platforms include Windows, macOS, and Linux kernels. Both consumer and enterprise deployments of Chrome are in scope. Organizations should inventory Chrome instances across their estate and verify installed versions.

Exploitability

Exploitation requires only network access and user interaction; no authentication or special system privileges are needed. An attacker simply crafts a malicious HTML page and waits for a victim to visit it. The low complexity and lack of prerequisites make this a practical attack vector for targeted phishing or watering-hole campaigns. However, the vulnerability does not grant code execution, limiting its chaining potential unless combined with other flaws.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome typically auto-updates; verify the installed version in Settings > About Chrome. For enterprise deployments, push the update via your device management solution (e.g., Google Admin, MDM platforms) and monitor deployment completion. No workarounds exist; patching is mandatory.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later as soon as feasible. Chrome's auto-update mechanism will push the patch automatically, though timely user restart is required. For managed environments, use Google Admin Console or Mobile Device Management (MDM) to deploy the patch to all users within 7–14 days of release. Verify patch installation by checking chrome://version in the browser or via MDM telemetry. No configuration changes are required post-patch.

Detection guidance

Monitor Chrome version telemetry to identify unpatched instances. Review browser crash logs and DevTools console for anomalous memory access warnings, though the vulnerability may leave minimal traces on successful exploitation. Endpoint detection and response (EDR) tools can alert on processes attempting unusual memory reads, but signature-based detection is limited without binary analysis. Network-based detection is ineffective since the attack occurs entirely in-process. Focus on version inventory as the primary detection mechanism.

Why prioritize this

While the CVSS score of 6.5 is moderate, the practical exploitability and ease of triggering via social engineering justify elevated priority. Unlike memory corruption flaws, this vulnerability does not enable lateral movement or privilege escalation, allowing organizations to defer patching behind other critical issues. However, apply the patch within your standard patch cycle (typically 2–4 weeks) to minimize data exfiltration risk, especially for roles handling sensitive information.

Risk score, explained

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns score 6.5 because the vulnerability permits remote, unauthenticated attackers to read process memory (high confidentiality impact) with low attack complexity but requires user interaction. The lack of integrity or availability impact prevents a higher score. For organizations housing highly sensitive data, the practical risk may exceed the base score due to adversary motivation and user susceptibility to phishing; consider contextual risk factors in your threat model.

Frequently asked questions