CVE-2026-13925: Chrome Downloads RCE on Windows – Patch to 150.0.7871.47

Technical summary

CVE-2026-13925 is an arbitrary code execution vulnerability stemming from improper input validation (CWE-20) in Chrome's Downloads implementation on Windows. The vulnerability exists in versions prior to 150.0.7871.47. The attack chain requires user interaction—specifically, deliberate UI gestures—to trigger the malicious payload embedded in a crafted HTML page. The Chromium project classified this as Medium severity at the code level, though the CVSS 3.1 assessment (7.5 HIGH) reflects the impact and exploitability profile: network-accessible, requires user action, but delivers complete system compromise (confidentiality, integrity, and availability impact).

Business impact

Successful exploitation could result in unauthorized access to sensitive corporate data, installation of persistent malware, lateral movement within a network, or data exfiltration. Given that Chrome is widely used for business workflows, an attacker exploiting this vulnerability could gain access to credentials, intellectual property, email, or other assets viewed or accessed through the browser. The requirement for user interaction means social engineering or targeted phishing campaigns would likely precede exploitation attempts.

Affected systems

Google Chrome on Microsoft Windows running versions prior to 150.0.7871.47 are affected. The vulnerability does not impact Chrome on macOS, Linux, or Android based on the description's Windows-specific scope. Any Windows user with Chrome installed and visiting an attacker-controlled or compromised website is at risk.

Exploitability

Exploitability is moderate and requires social engineering. An attacker must convince a user to visit a malicious webpage and then perform specific UI interactions (such as clicking, dragging, or other gestures) to trigger the payload. This is not a one-click or passive attack; it demands deliberate user actions, which raises the bar compared to drive-by attacks but remains realistic in targeted or mass-phishing scenarios. No public exploit code is known to be widely available at present.

Remediation

Immediately update Google Chrome to version 150.0.7871.47 or later on all Windows systems. Users can check their current version in Chrome Settings > About Chrome, which will automatically prompt an update if one is available and install it on the next browser restart. Organizations should enforce automatic updates through group policy, mobile device management (MDM), or browser management tools to ensure timely patching across their user base.

Patch guidance

Google Chrome auto-updates by default, but users should manually verify they are running version 150.0.7871.47 or higher. Navigate to chrome://settings/help in the address bar to check version and force an update if needed. For enterprise environments, leverage Chrome's managed preferences (enterprise.google.com) to enforce automatic updates and prevent users from disabling them. Test patched builds in a non-production environment first to confirm no compatibility issues with internal applications or extensions.

Detection guidance

Monitor Chrome version compliance across your infrastructure using MDM tools, endpoint detection and response (EDR) solutions, or browser inventory software. Hunt for suspicious child processes spawned from Chrome, unusual file write activity in the Downloads folder, or unexpected registry modifications that may indicate successful exploitation. Network-level detection is challenging because the attack leverages legitimate browser downloads; focus on behavioral indicators such as reconnaissance activity, credential theft, or malware staging following a suspected infection window.

Why prioritize this

Although not yet on CISA's KEV (Known Exploited Vulnerability) catalog, this vulnerability warrants high-priority patching due to its HIGH CVSS score, the potential for remote code execution, the ubiquity of Chrome, and the relatively low bar for triggering user interaction in targeted attacks. The Windows-specific scope means all Windows-based Chrome users are at risk. Organizations should treat this as a critical patch, particularly for users in high-risk roles (executives, researchers, developers) who may be targeted by sophisticated threat actors.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible vulnerability with high impact across all security dimensions (confidentiality, integrity, availability). The attack complexity is set to HIGH because it requires deliberate user interaction via specific UI gestures, which limits opportunistic attacks. However, the score does not require authentication or special system privileges, making it accessible to remote attackers. The overall rating balances the ease of code execution (once interaction is triggered) against the practical difficulty of convincing users to perform those gestures.

Frequently asked questions