CVE-2026-13897: Chrome Chromecast Policy Enforcement Flaw Allows Privilege Escalation

Technical summary

CVE-2026-13897 stems from insufficient policy enforcement within Chrome's Chromecast integration (CWE-284: Improper Access Control). The vulnerability permits a remote, unauthenticated attacker to escalate privileges by delivering a specially crafted HTML page to a victim. The attack requires user interaction—the target must visit or be directed to the malicious page—but no special attacker capabilities or preconditions are needed. The resulting compromise grants the attacker the full execution context of the affected user's Chrome process, enabling data theft, credential capture, and further lateral movement.

Business impact

Successful exploitation directly threatens confidentiality, integrity, and availability of user data within the browser context. Organizations relying on Chrome for sensitive work face risk of credential compromise, intellectual property theft, and potential supply-chain exposure if employees' machines are used to pivot into corporate networks. The requirement for user interaction limits mass-scale exploitation but makes phishing and social engineering vectors particularly relevant. Reputational damage and potential regulatory obligations (depending on data classification) may follow a compromise.

Affected systems

Google Chrome versions prior to 150.0.7871.47 are affected. This includes all supported Chrome release channels (Stable, Beta, Dev) running vulnerable versions across Windows, macOS, Linux, iOS, and Android platforms. Organizations using Chrome in managed environments should prioritize inventory of current patch levels.

Exploitability

The attack is network-accessible with no authentication required and low complexity, but does demand user interaction (UI:R). The vector requires the target to visit a crafted webpage, typically via phishing, malicious ad, or social engineering. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating no widespread active exploitation at the time of this analysis. However, the relative simplicity and high-impact nature (privilege escalation within a high-trust context) make weaponization practical and likely once exploit details mature.

Remediation

Patch Chrome to version 150.0.7871.47 or later. Organizations should enforce auto-update policies or use managed Chrome enterprise deployment to accelerate patching. Until patching is complete, user education about link safety and email/web filtering to reduce phishing success rates provide interim mitigation but do not eliminate the risk.

Patch guidance

Update Chrome via Settings > About Google Chrome, which typically triggers automatic download and installation on next restart. Enterprise administrators should verify patch deployment through Chrome's Device Management or similar MDM solutions. Test patches in non-production environments first if using custom configurations or extensions. Verify the active version in chrome://version/ after update.

Detection guidance

Monitor for Chrome process crashes or unexpected privilege escalation attempts within browser sandboxes. Endpoint detection and response (EDR) tools should flag suspicious HTML file writes or network connections initiated from the Chrome renderer process. Web proxies and email gateways can block known malicious domains. Internal threat hunting should focus on anomalous credential usage following potential exposure windows. Consider behavioral analysis for signs of post-compromise activity (e.g., unusual data exfiltration, lateral movement from Chrome-running systems).

Why prioritize this

Despite Chromium's internal severity rating of 'Medium,' the CVSS 3.1 score of 8.8 reflects the high impact: network attack vector, no authentication, user interaction only (not a blocker), and complete compromise of confidentiality, integrity, and availability within the user context. Privilege escalation flaws are consistently high-priority because they enable follow-on attacks. Chrome's ubiquity in business environments amplifies the organizational risk.

Risk score, explained

CVSS 3.1 score of 8.8 (HIGH severity) is driven by: (1) AV:N—remote exploitation over the network, (2) AC:L—no special conditions required, (3) PR:N—no prior access needed, (4) UI:R—user must click/visit the malicious page, (5) S:U—impact is confined to the user's scope, (6) C:H, I:H, A:H—all three security properties fully compromised. This combination places it in the HIGH range and warrants prompt action, particularly for organizations where Chrome is a primary work tool.

Frequently asked questions