CVE-2026-13874: Chrome DataTransfer Race Condition Memory Disclosure Vulnerability

Technical summary

CVE-2026-13874 is a race condition (CWE-362) in the DataTransfer functionality of Google Chrome prior to version 150.0.7871.47. The vulnerability allows an unauthenticated remote attacker to obtain sensitive information from process memory via a specially crafted HTML page. The attack vector is network-based and requires user interaction. The Chromium security team classified this as medium severity due to the confidentiality impact combined with the need for specific timing conditions and user engagement. The vulnerability affects Chrome on Windows, macOS, and Linux systems.

Business impact

The primary business risk is unauthorized disclosure of sensitive data from affected processes. Depending on what data is accessible in memory at the time of exploitation, this could include cached credentials, session tokens, personal information, or internal application state. For enterprises, the threat is moderate but not insignificant—a targeted campaign could extract valuable data from users browsing internal or partner websites. However, the race condition requires careful timing and user interaction, which limits the scope compared to direct remote code execution vulnerabilities.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The issue affects Chrome running on Microsoft Windows, Apple macOS, and Linux systems. Chrome on other platforms (Android, iOS) may also be affected; verify with the official Chrome release notes. Users of Chromium-based browsers (Edge, Brave, Opera) should check their respective vendor advisories for patched versions.

Exploitability

Exploitation requires a remote attacker to craft a malicious HTML page and trick a user into visiting it. The attacker cannot force the visit; the user must click a link or navigate to the malicious site. Additionally, the race condition must be timed correctly, meaning reliability of exploitation is not guaranteed. This limits widespread weaponization but does not eliminate the risk, particularly in targeted scenarios. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no observed in-the-wild exploitation at the time of publication, though this does not guarantee future safety.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later. The fix addresses the race condition in DataTransfer. Enable automatic updates if not already configured. For enterprise environments, use Chrome enterprise policies to enforce updates or deploy the patched version through managed software distribution. Also advise users to avoid clicking suspicious links and to keep browser extensions minimal, as additional processes can increase memory exposure surface.

Patch guidance

Google has released Chrome 150.0.7871.47 as the fix. Verify the installed version via Chrome menu > About Google Chrome, which will show the current version and auto-update status. For macOS users, also confirm that OS-level security updates are applied, as the vulnerability affects the full Chrome application stack on that platform. Linux users should obtain the update from their distribution's package manager or directly from Google's download page. Chromium-based browser vendors (Microsoft Edge, Brave, etc.) should have released coordinated patches; check those vendors' security advisories.

Detection guidance

Monitor for Chrome process activity involving DataTransfer operations with unusual memory access patterns. Endpoint detection tools should flag attempts to read process memory across privilege boundaries. Additionally, network-based detection should identify suspicious HTML content referencing DataTransfer APIs with uncommon timing or asynchronous patterns. However, given the race condition nature, signature-based detection is challenging; focus on behavioral anomalies and ensure that web filtering solutions block known malicious sites. No specific network indicators are available without samples of actual exploits.

Why prioritize this

This vulnerability merits prompt but not emergency attention. The CVSS score of 5.3 (Medium) reflects the confidentiality risk balanced against the need for user interaction and timing precision. It does not pose a denial-of-service or code execution threat. Prioritize patching for users who frequently visit untrusted websites or access sensitive information in the browser (e.g., email, financial services, internal systems). For low-risk users in controlled environments, a standard patching window is acceptable, but enterprises should plan updates within days rather than weeks.

Risk score, explained

The CVSS v3.1 score of 5.3 (Medium) is derived from the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. The score reflects: high confidentiality impact (C:H) because process memory can leak sensitive data; no integrity or availability impact; network attack vector (AV:N); high attack complexity (AC:H) due to the race condition requirement; and required user interaction (UI:R). The lack of privilege requirements (PR:N) prevents the score from being lower. This is a classic information disclosure vulnerability where timing and luck play a role, making it non-trivial but still actionable for adversaries in targeted campaigns.

Frequently asked questions