CVE-2026-13890: Out-of-Bounds Read in Chrome Chromecast

Technical summary

CVE-2026-13890 is an out-of-bounds read vulnerability (CWE-125) in the Chromecast implementation within Chromium. The flaw permits an attacker with renderer process compromise to craft a malicious HTML payload that triggers an out-of-bounds memory access, exposing adjacent process memory. The vulnerability is classified as Medium severity by Chromium and assigned a CVSS 3.1 score of 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Exploitation requires both renderer process compromise and user interaction, limiting but not eliminating real-world risk.

Business impact

This vulnerability primarily threatens organizations where users browse untrusted content or may be targeted by sophisticated phishing attacks. Since exploitation requires prior renderer compromise, the attack chain is two-stage: first compromise the browser process (via another vulnerability or malware), then exploit this flaw to leak credentials, authentication tokens, or other sensitive data held in memory. For enterprises with strict browsing policies and defense-in-depth controls, immediate business impact is limited; however, the information disclosure risk to high-value targets warrants prompt patching.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are vulnerable. The flaw affects Chrome running on Microsoft Windows, Apple macOS, and Linux systems. All platforms running unpatched versions are equally at risk. Organizations should inventory Chrome deployments across managed and unmanaged endpoints.

Exploitability

Exploitation is not trivial. An attacker must first achieve renderer process compromise—typically through a separate vulnerability or social engineering—and then convince the user to interact with a crafted HTML page. The CVSS vector (AC:H, UI:R) reflects these requirements. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active, weaponized exploitation has been publicly confirmed as of the publication date. However, the attack is feasible for well-resourced threat actors targeting high-value individuals or organizations.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chromium-based browsers (Microsoft Edge, Brave, Opera) derived from affected Chromium versions should also be updated to their corresponding patched releases. Verify patch versions against vendor release notes, as different browsers may have staggered release schedules. No workarounds are available; patching is the primary mitigation.

Patch guidance

Chrome auto-updates are enabled by default for most users; however, enterprises with managed deployments should validate that auto-update policies are active or manually deploy version 150.0.7871.47 or later. Test patches in a non-production environment before full rollout if your organization requires change control. Check vendor advisories for any known compatibility issues with legacy extensions or internal web applications. Chromium-based alternatives (Edge, Brave) should be updated to their corresponding patched releases—verify the exact version numbers against each vendor's security advisory.

Detection guidance

Monitor Chrome version compliance across endpoints using endpoint detection and response (EDR) or mobile device management (MDM) tools. Logs of renderer process crashes may indicate exploitation attempts, though they are not definitive. Network-based detection is challenging since the exploit payload is contained within HTML; focus on endpoint-level inventory and patch compliance. If your organization logs browser activity, look for unusual patterns preceding renderer process anomalies.

Why prioritize this

Although assigned a Medium severity score and not yet exploited in the wild, this vulnerability merits timely patching due to its information disclosure risk and the simplicity of patching Chrome across most environments. Organizations should prioritize this above less critical updates but need not declare a crisis-level incident response. The lack of KEV listing and active exploitation reduces urgency relative to critical or high-severity flaws, but prompt patching within standard change windows is prudent.

Risk score, explained

The CVSS 3.1 score of 5.3 (Medium) reflects confidentiality impact (C:H) balanced against high attack complexity (AC:H) and the requirement for user interaction (UI:R). The attacker gains no code execution, persistence, or denial-of-service capability. The score appropriately captures that exploitation is possible but non-trivial, and the impact is limited to information disclosure rather than system compromise. Real-world risk may vary based on whether your users are targeted by advanced threat actors and whether additional renderer-process vulnerabilities exist in your deployment timeline.

Frequently asked questions