CVE-2026-13911: Google Chrome Spell-Check Memory Disclosure Vulnerability

Technical summary

CVE-2026-13911 is a policy enforcement flaw in the Chromium spell-check subsystem that permits information disclosure from process memory. The vulnerability exists in the interaction between the spell-check feature and the renderer process sandbox. An attacker with renderer process compromise can craft HTML that bypasses spell-check policy controls to exfiltrate sensitive data resident in memory. The issue is rooted in insufficient input validation or policy application (CWE-20), allowing attackers to escape intended protections. The CVSS 3.1 score of 5.3 (MEDIUM) reflects the requirement for prior renderer compromise and user interaction, though the confidentiality impact is rated high once conditions are met.

Business impact

This vulnerability poses a moderate but real risk to Chrome users who may already be compromised by other exploits. The attack does not compromise Chrome directly but extracts data from an already-compromised renderer process, making it valuable to attackers performing multi-stage exploitation. Organizations relying on Chrome as a security boundary should note that compromised renderer processes can now leak sensitive information including cached credentials, session data, or other memory contents. Delayed patching increases the window for multi-exploit campaigns to succeed.

Affected systems

Google Chrome prior to version 150.0.7871.47 is affected. This includes all earlier versions on Windows, macOS, and Linux platforms. Users on Chrome 150.0.7871.47 and later are not vulnerable. The vulnerability is specific to the Chromium spell-check implementation and does not affect other Chromium-based browsers unless they ship identical vulnerable code, though verify with individual vendor advisories.

Exploitability

The vulnerability requires a two-stage attack: first, the attacker must compromise the Chrome renderer process through a separate vulnerability or attack vector, then craft a malicious HTML page to trigger the spell-check bypass. This dependency on prior renderer compromise significantly limits exploitability in isolation. However, in active exploitation campaigns combining multiple vulnerabilities—particularly renderer escapes or memory corruption bugs—this becomes a high-value secondary payload to extract secrets before the victim detects the initial breach. No public proof-of-concept is required; the vulnerability is not tracked as a KEV (Known Exploited Vulnerability).

Remediation

Immediate patching to Chrome 150.0.7871.47 or later is the sole remediation. The patch implements proper policy enforcement in the spell-check subsystem to prevent the memory disclosure. Users should enable automatic Chrome updates to receive the fix automatically. Organizations managing Chrome deployments should verify patch deployment within their fleet and confirm no users remain on vulnerable versions.

Patch guidance

Update Google Chrome to version 150.0.7871.47 or later. For enterprise deployments, use your organization's Chrome update policy to enforce the minimum version. Verify via chrome://version in the browser's address bar that the deployed version matches or exceeds the patched release. Users can manually check Settings > About Chrome to trigger immediate update checks. No rollback or workaround is available; patching is mandatory.

Detection guidance

Detection of active exploitation is difficult because it requires prior renderer compromise combined with spell-check interaction on a crafted page. Endpoint Detection and Response (EDR) tools should monitor for unusual Chrome process behavior, memory access patterns, or suspicious child processes that may indicate renderer process compromise. Network detection is ineffective because the malicious content arrives over normal HTTPS traffic. Monitor for exploitation of related renderer vulnerabilities (CVEs affecting memory safety) as a leading indicator of multi-stage attacks leveraging this CVE. Consider blocking access to untrusted websites where this secondary stage might be hosted.

Why prioritize this

This CVE should be prioritized based on organizational risk profile: High priority for organizations where Chrome users are frequent targets of advanced exploitation campaigns or where credential theft from browser memory represents a significant data loss risk. Medium priority for general business environments where renderer compromise is less likely. The MEDIUM CVSS score and KEV-non-status indicate this is not an emergency but should not be deferred beyond standard patching cycles. Patch within 30 days to reduce the window for multi-stage attacks.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects the attack complexity (High), requirement for user interaction, and dependency on prior renderer process compromise. These factors prevent a higher score despite high confidentiality impact. The score accurately represents that this is not a worm vector or direct remote code execution path, but rather a targeted data exfiltration tool for sophisticated attackers who have already compromised the renderer. Organizations should not underestimate this score in multi-vulnerability attack scenarios where it serves a critical secondary role.

Frequently asked questions