CVE-2026-13958: Chrome Windows Codec Information Disclosure Vulnerability

Technical summary

CVE-2026-13958 is an uninitialized variable vulnerability (CWE-457) in Chromium's codec subsystem on Windows. The flaw occurs when codec operations reference memory that has not been properly initialized, creating an information disclosure vector. Exploitation requires user interaction (visiting a malicious HTML page) and network access, but no special privileges or complex exploitation techniques. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Windows systems.

Business impact

Information disclosure from browser memory can expose credentials, authentication tokens, personal data, and other sensitive information users believe is protected by the browser sandbox. For organizations, this represents a risk to employee accounts and credentials if staff access untrusted or compromised websites. The attack surface is broad because it only requires a user to visit a webpage—no download or additional user action is needed beyond normal browsing.

Affected systems

Google Chrome on Windows versions before 150.0.7871.47. The vulnerability does not affect Chrome on macOS, Linux, or Android, nor does it affect other Chromium-based browsers unless they independently backport the vulnerable codec code. Organizations running Chrome on Windows infrastructure or relying on Windows-based employee browsing should prioritize assessment.

Exploitability

The vulnerability is practical to exploit: it requires only network access and user interaction (visiting a webpage), has low attack complexity, and needs no authentication or special privileges. An attacker could host the exploit on a legitimate-looking website, advertise it through social engineering, or inject it into compromised ad networks. The barrier to weaponization is low, which is why this is classified as medium severity rather than low despite the information-disclosure-only impact.

Remediation

Update Google Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism typically delivers patches automatically within hours to days, but administrators should verify deployment across their Windows estate. For organizations unable to immediately patch, consider restricting access to untrusted websites or running Chrome in a sandboxed environment with reduced memory access.

Patch guidance

Google Chrome versions on Windows should be updated to 150.0.7871.47 or newer. Verify the installed version via Chrome menu > Help > About Google Chrome, which will show the current version and trigger an update check if needed. For enterprise deployments, consult your Chrome Enterprise policy management console or Google Update Group Policy settings to confirm patch distribution. No manual installation steps are typically required; the patch is delivered via Chrome's standard update channels.

Detection guidance

Monitor for Chrome updates to version 150.0.7871.47 or later across your Windows fleet using your endpoint management platform or Chrome reporting. Hunt for suspicious codec operations or memory access patterns in process logs if you have system-level monitoring enabled. DNS/URL filtering can help block known malicious HTML pages hosting exploits, though new variants are possible. Endpoint Detection & Response (EDR) solutions may flag suspicious memory reads tied to codec operations if configured with appropriate behavioral rules.

Why prioritize this

Although the CVSS score is medium (6.5), this vulnerability warrants prompt attention because it combines broad user impact (any Windows Chrome user is at risk), practical exploitability (no special conditions), and a clear attack surface (malicious webpages). The lack of KEV status does not indicate low severity—it reflects the lack of confirmed active exploitation in the wild at the time of publication, not the inherent risk. Organizations should treat this as a standard-priority patch for Windows endpoints.

Risk score, explained

CVSS 3.1 score of 6.5 reflects a medium-severity information disclosure vulnerability. The score accounts for network attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), required user interaction (UI:R), and high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). The user interaction requirement prevents this from being a critical remote code execution, but the confidentiality impact and ease of exploitation elevate it above low severity.

Frequently asked questions