CVE-2026-13875: Chrome GPU Input Validation Flaw Requires Prior Renderer Compromise

Technical summary

CVE-2026-13875 involves insufficient input validation in the GPU subsystem of Chrome's renderer process. The flaw allows an attacker with renderer process compromise to craft malicious HTML that triggers the GPU driver to expose process memory contents. The vulnerability is rooted in CWE-20 (Improper Input Validation), affecting Chrome versions before 150.0.7871.47 on Windows. The attack surface is limited by the requirement that the renderer must already be compromised and user interaction (visiting a malicious page) is required, which explains the CVSS base score of 5.3 and HIGH confidentiality rating despite the Medium severity designation.

Business impact

Organizations with Windows desktops and Chrome deployments face a secondary-layer risk: if a user's browser renderer is already compromised—perhaps through a prior vulnerability or malware—an attacker can escalate to extract sensitive data like authentication tokens, encryption keys, or other credentials held in process memory. This could lead to lateral movement within corporate networks or unauthorized access to cloud services. The practical impact depends on whether your environment has other vulnerabilities that could lead to renderer compromise first.

Affected systems

Google Chrome on Windows systems prior to version 150.0.7871.47 are affected. Both the Chrome browser and Windows OS are listed as affected vendors. Notably, this is Windows-specific; Chrome on other platforms is not affected by this particular GPU validation flaw.

Exploitability

This vulnerability has a relatively high barrier to exploitation. The attacker must first compromise the Chrome renderer process—a sandboxed environment with restricted privileges—before they can exploit this flaw. The attack is not a one-click vulnerability; it requires the user to visit a specially crafted webpage while the renderer is already under attacker control. No public exploits have been identified (not listed in the Known Exploited Vulnerabilities catalog), and the attack chain makes mass exploitation unlikely. However, in targeted scenarios involving users already exposed to malware or advanced persistent threats, the risk is meaningful.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Google has patched the input validation logic in the GPU subsystem. Organizations managing Chrome deployments should prioritize this update, though the risk is lower than zero-day renderer escapes since this requires prior compromise. Verify the installed version in Chrome settings under About Chrome to confirm automatic updates have applied the patch.

Patch guidance

Chrome's auto-update mechanism will deploy version 150.0.7871.47 automatically; users can accelerate this by opening Settings > About Chrome and manually checking for updates. Organizations using Chrome Enterprise should deploy the patch through their standard update management channels. No workarounds or configuration changes can mitigate this vulnerability—patching is the only remediation. Test the update in a non-production environment first if your organization has custom Chrome policies or extensions.

Detection guidance

Detection of exploitation requires visibility into GPU driver interactions and process memory access patterns. Organizations with behavioral analytics or memory forensics capabilities should monitor for unusual GPU API calls following renderer compromise or suspicious memory read patterns. However, this is difficult to detect at the network level since the attack occurs within process memory. Detect the vulnerability's presence by auditing Chrome versions across your Windows fleet—query Windows Update or Chrome management endpoints for instances running pre-150.0.7871.47 versions. User behavior analytics may flag unusual credential usage following renderer compromise, but that would indicate post-exploitation activity rather than the vulnerability itself.

Why prioritize this

While this is a real vulnerability with HIGH confidentiality impact, it scores lower in immediate risk because it requires prior renderer compromise. Organizations should prioritize it as part of regular Chrome update cycles but do not need emergency patching unless there is known renderer malware in the environment. Chains of vulnerabilities that lead to renderer compromise should be treated as higher-priority targets for patching. If your organization has already patched other Chrome renderer vulnerabilities or has comprehensive endpoint protection, this drops further in priority.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the vulnerability's design: Network reachability and user interaction lower the exploitability score (AC:H, UI:R), but the HIGH confidentiality impact (C:H) acknowledges that successful exploitation results in memory disclosure. The score does not increase to HIGH or CRITICAL because the attack requires an already-compromised renderer process, which is a significant precondition. This is not a vulnerability that turns an unauthenticated visitor into a data thief—it is a step in a longer attack chain.

Frequently asked questions