CVE-2026-13888: Chrome Extension Use-After-Free RCE Vulnerability – Patch 150.0.7871.47

Technical summary

CVE-2026-13888 is a use-after-free vulnerability (CWE-416) in Chrome's extension subsystem that allows remote code execution within the extension sandbox. The flaw exists in how Chrome manages memory during extension lifecycle operations. When a specially crafted HTML page is served to a victim, it can trigger a sequence that frees memory prematurely, then reuses that freed memory location. By controlling the contents of the reallocated memory, an attacker achieves arbitrary code execution in the sandboxed context. While the exploit is limited to the extension sandbox rather than full system access, this still represents a significant security breach given the sensitivity of extension APIs and data access.

Business impact

This vulnerability poses a direct threat to Chrome users across enterprise and consumer deployments. Attackers can harvest sensitive data accessible to extensions, including authentication tokens, saved passwords in extension storage, and user browsing context. For organizations relying on Chrome-based enterprise security or administrative extensions, compromise could enable lateral movement or privilege escalation. The requirement for user interaction (clicking a link or visiting a site) makes phishing and watering hole attacks practical vectors. Organizations should expect active exploitation attempts targeting high-value users once patches are widely available.

Affected systems

Google Chrome versions prior to 150.0.7871.47 running on Windows, macOS, and Linux are vulnerable. This includes all Chromium-based browsers that incorporate the vulnerable code. The vulnerability affects both consumer and enterprise deployments of Chrome, with no known workarounds that preserve full functionality.

Exploitability

The vulnerability requires user interaction—a victim must visit or be redirected to a malicious webpage. This makes it well-suited for phishing campaigns, malicious advertising, and compromised site injections. Once the page loads, the exploit executes automatically in the background. No special user privileges or system configuration is required to trigger the vulnerability. Given that the attack surface is the open web and billions of Chrome users browse daily, the practical exploitability is high. However, it is not yet listed on CISA's Known Exploited Vulnerabilities catalog, indicating either limited real-world weaponization or recent discovery.

Remediation

Apply Chrome security update 150.0.7871.47 or later immediately. Organizations should deploy this patch via their Chrome enterprise management tools (Google Admin Console, cloud device management, or local software distribution) to all endpoints within 48–72 hours. End users should enable automatic updates if not already configured. Verify patch deployment by checking chrome://version in the address bar to confirm the installed version number.

Patch guidance

Google has released Chrome version 150.0.7871.47 as the stable branch fix. Verify against Google's official Chrome release notes at https://chromereleases.googleblog.com to confirm your target version. For enterprise deployments: (1) use Google Admin Console to set the minimum Chrome version policy; (2) monitor device compliance reports for non-compliant machines; (3) force immediate updates on critical systems. For consumer users: enable automatic updates in Chrome Settings > About Google Chrome > check for updates. No manual version selection is necessary. Rollback is not recommended; earlier versions remain vulnerable.

Detection guidance

Monitor for exploitation attempts via network signatures or endpoint telemetry: (1) watch for unusual child processes spawned by the Chrome sandbox, particularly those accessing sensitive file paths; (2) correlate suspicious extension behavior with visits to unfamiliar or suspicious domains around the same timeframe; (3) monitor extension API calls for data exfiltration patterns (file access, credential storage queries); (4) check Chrome extension activity logs for unexpected permissions grants or policy violations. Organizations with EDR tools should create detection rules for sandbox escape behaviors or anomalous extension execution contexts.

Why prioritize this

This vulnerability warrants immediate patching due to the combination of a high CVSS score (8.8), active attack surface (web browsing), and sandbox escape implications. Although not yet in CISA's KEV catalog, the ease of exploitation via malicious websites and the sensitivity of extension-level access make this a priority for rapid remediation. Organizations should treat this as a critical update rather than deferring to regular patch cycles.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction required (UI:R), unchanged scope (S:U), and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). While the sandbox boundary provides some containment, the ability to execute arbitrary code within the extension context poses severe risk to user data and system integrity. The user interaction requirement (UI:R) prevents a perfect 9.0+ score but does not substantially reduce real-world risk given web browsing frequency.

Frequently asked questions