CVE-2026-13877: ANGLE Memory Disclosure in Google Chrome—Patch & Guidance

Technical summary

CVE-2026-13877 is an insufficient input validation flaw in ANGLE (Almost Native Graphics Layer Engine), Chrome's graphics abstraction layer. The vulnerability exists in how ANGLE processes untrusted input without proper sanitization, enabling memory disclosure from the compromised renderer process. An attacker with renderer-level code execution can craft HTML content that triggers out-of-bounds memory reads, leaking data that may contain sensitive information such as encryption keys, authentication tokens, or other process-resident secrets. The issue is tracked as CVSS 5.3 (Medium) with a vector reflecting network accessibility but requiring both renderer compromise and user interaction.

Business impact

This vulnerability reduces defense-in-depth by turning renderer exploits into information disclosure attacks. Organizations defending against browser-based attacks face increased risk if other Chrome vulnerabilities are leveraged first to gain renderer access. The ability to exfiltrate memory contents could expose session tokens, cached credentials, or sensitive document data processed by web applications. For enterprises using Chrome in security-sensitive environments (development teams, financial services, government), this compounds the impact of renderer sandbox escapes or other process compromises.

Affected systems

Google Chrome prior to version 150.0.7871.47 on Windows, macOS, and Linux is affected. The vulnerability is in the ANGLE graphics library, which is cross-platform, so all three operating system builds of Chrome require patching. Linux kernel and Windows versions listed as affected vendors refer to the underlying operating systems where Chrome runs; the vulnerability itself is specific to Chrome's ANGLE implementation.

Exploitability

Exploitation requires a two-stage attack: first, the attacker must compromise the Chrome renderer process through a separate vulnerability or exploit. Second, they must deliver a crafted HTML page to the user. Once renderer access is established, the ANGLE validation flaw is reliably exploitable to leak memory. Chromium's sandbox architecture means this is not a network-direct remote code execution risk, but it significantly amplifies the impact of renderer-level compromises. The requirement for user interaction (visiting a webpage) and the need for prior renderer compromise keeps the CVSS score moderate.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Automatic updates should deploy this patch across Windows, macOS, and Linux installations. Organizations managing Chrome fleet-wide should verify patch deployment through their endpoint management tools. There is no workaround; patching is the only mitigation. Given the memory-disclosure nature, organizations should also assess whether other browser vulnerabilities have been exploited in their environment, as this vulnerability often acts as a secondary payload.

Patch guidance

Deploy Chrome version 150.0.7871.47 or later across all affected platforms. On Windows and macOS, Chrome's auto-update mechanism will push the patch if enabled. On Linux, distribution package managers or manual updates may be required depending on deployment method. Verify installation with chrome://version in the address bar. If your organization uses Chrome Enterprise or Chromebook management, use admin policies to force immediate update and restrict use of older versions. Test patched builds in a limited environment first if you manage corporate deployments, though this is a Chromium-validated security fix with low regression risk.

Detection guidance

Monitor for Chrome crashes or unusual renderer behavior following deployment, which could indicate either the vulnerability being exploited or patch-related issues. Analyze network telemetry for unusual outbound connections from Chrome processes post-compromise, as memory disclosure attacks often precede data exfiltration. Security event logs should flag renderer process terminations and restarts in rapid succession. Endpoint Detection and Response (EDR) tools can monitor for suspicious ANGLE library access patterns, though detection of the vulnerability itself is difficult without behavioral anomalies. Focus monitoring on users who may be targeted by sophisticated attackers or who browse untrusted content.

Why prioritize this

Although CVSS 5.3 is moderate, this vulnerability should be prioritized because it is a secondary amplifier of other browser exploits. Patching reduces the attack surface for multi-stage campaigns targeting your users. It is not critical for standalone exploitation, but it prevents attackers from weaponizing subsequent renderer compromises for information theft. Organizations with high-value targets (developers, researchers, financial analysts) should patch immediately.

Risk score, explained

CVSS 5.3 (Medium) reflects the requirement for both renderer compromise and user interaction, tempering the severity. However, the attack vector is Network and the impact is Confidentiality High—meaning memory disclosure can be substantial. The score is appropriate: this is not a critical sandbox escape, but it is a meaningful information disclosure vulnerability that becomes dangerous in combination with other Chrome flaws. Prioritization should account for your threat model and whether you expect targeted attacks against your user base.

Frequently asked questions