CVE-2026-13906: Chrome Out-of-Bounds Read in Codecs—Data Disclosure Risk

Technical summary

This vulnerability exists in Chrome's codec implementation where insufficient bounds checking allows an out-of-bounds memory read. When processing specially crafted media content embedded in an HTML page, the codec parser fails to validate read operations against allocated buffer boundaries. An attacker-controlled webpage can trigger the vulnerable code path, allowing the process to read and exfiltrate adjacent memory regions. The CWE-125 classification confirms this is a classic out-of-bounds read flaw. No code execution or denial-of-service capability is present; the attack is limited to information disclosure from the Chrome renderer process context.

Business impact

This vulnerability primarily threatens user data confidentiality. If exploited, an attacker could potentially harvest sensitive information resident in Chrome's memory at the time of the attack—such as session tokens, cached credentials, personal data from open tabs, or cryptographic material. While not critical, the threat is meaningful in scenarios where users visit untrusted websites or click malicious links sent via phishing. For organizations, this affects any user population running outdated Chrome builds, with risk proportional to exposure to unvetted web content and the sensitivity of data typically cached in their users' browsers.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all platforms where Chrome runs (Windows, macOS, Linux, Android, iOS). Organizations using managed Chrome deployments should verify their current version and deployment schedules. Chromebook environments, cloud-based browser solutions, and standard desktop/mobile deployments are all in scope. The vulnerability does not affect other Chromium-based browsers such as Edge unless they independently maintain similar codec code; verify vendor advisories for derivative products.

Exploitability

Exploitability is straightforward but requires user action. An attacker must craft a malicious HTML page containing specially formatted media content designed to trigger the out-of-bounds read. The page must be served to a target user—via phishing email, watering hole attack, malvertising, or social engineering. No authentication, special configuration, or elevated privileges are required on the victim's machine. The attack surface is broad: any webpage the user visits could be weaponized. However, successful data exfiltration requires the attacker to infer or detect which sensitive data was read, which adds practical friction to reliable exploitation. No public exploit code is known at this time, and the vulnerability is not tracked on the CISA KEV catalog.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism will push this version; users should restart their browser to apply the update. Organizations managing Chrome deployments via mobile device management (MDM), endpoint management platforms, or domain policy should verify update deployment and user compliance. There is no workaround; patching is the only mitigation. Users who cannot patch immediately should restrict browsing to trusted sites and avoid clicking suspicious links.

Patch guidance

Google Chrome auto-updates by default; users will receive version 150.0.7871.47 and should restart to complete the upgrade. For managed deployments: verify through your MDM console or Chrome policy dashboard that all managed devices have updated. If auto-update is disabled in your environment, manually deploy the new version through your standard patch management workflow. Test the update in a non-production environment first if your organization has custom extensions or integrations. Refer to Google's official Chrome release notes for complete details and any platform-specific deployment notes.

Detection guidance

Monitor for Chrome version compliance: verify that devices in your environment are running 150.0.7871.47 or later using endpoint asset management tools, mobile device management consoles, or manual audits of chrome://version. Check for any alerts from Chrome crash reporting that might indicate exploitation attempts (though detection at the endpoint is difficult for information disclosure flaws). Network-level detection is impractical; focus on ensuring timely patching rather than post-exploitation detection. Consider browser telemetry and crash reports as weak signals of potential attack activity.

Why prioritize this

This vulnerability merits prompt patching despite its CVSS 6.5 (Medium) rating. The combination of broad attack surface (any website), ease of exploitation (user visits page), lack of required privileges, and potential for sensitive data disclosure justifies rapid deployment in most organizations. The absence from the CISA KEV catalog indicates no active in-the-wild exploitation at the time of publication, offering a window for orderly patching. However, do not delay: codec vulnerabilities are popular targets for information-stealing campaigns, and this flaw could be weaponized quickly once widely known.

Risk score, explained

CVSS 6.5 reflects a Medium-severity information disclosure vulnerability with network accessibility and user interaction required. The score acknowledges that confidentiality impact is high (sensitive memory can be read), but integrity and availability are unaffected. Attack complexity is low (straightforward to craft malicious media), and no privileges are required. The user interaction requirement (visiting a webpage) prevents a fully autonomous attack but does not eliminate the threat—such interactions are frequent and often triggered through phishing or social engineering.

Frequently asked questions