CVE-2026-13965: Chrome Oilpan Use-After-Free Remote Code Execution

Technical summary

The vulnerability is a use-after-free (CWE-416) in Oilpan, Google's incremental garbage collection system for the Blink rendering engine. Oilpan manages memory for DOM objects and other renderer-process allocations. The flaw permits an attacker to reference memory that has already been freed, allowing out-of-bounds reads, writes, or control-flow hijacking. The attack vector is a crafted HTML document served over the network. When the victim's browser parses and renders the page, the malicious content triggers the use-after-free condition. Execution occurs in the renderer process sandbox, limiting lateral movement but granting full compromise of that isolated context.

Business impact

Any user running affected Chrome versions who visits a malicious website risks compromise of their browser session, cached credentials, and any sensitive data visible to that renderer process. For enterprises, this threatens credential theft from browser-based authentication, exfiltration of intellectual property from web applications, and potential lateral movement if the compromised browser is used to access internal systems or services that trust the user's authenticated session.

Affected systems

Google Chrome versions prior to version 150.0.7871.47 are affected. This includes all stable, beta, and extended stable release channels below that version. Chrome on Windows, macOS, and Linux all ship the same Oilpan code and are similarly vulnerable. Users of Chromium-based browsers that incorporate unpatched Oilpan code may also be at risk; verify with your specific browser vendor.

Exploitability

This vulnerability has a low barrier to exploitation. No user interaction beyond visiting a website is required—the attack is fully automatic upon page load. The attack surface is enormous: any compromised website, advertisement, or attacker-controlled domain can host the exploit. Network access and UI interaction (visiting a link) are the only prerequisites, making this a critical remote code execution threat in practice. The CVSS score of 8.8 (High) reflects this profile, despite Chromium internally rating it Medium severity (likely accounting for sandbox containment).

Remediation

Immediately update Chrome to version 150.0.7871.47 or later. Chrome's auto-update mechanism will deploy the fix; users should restart the browser to apply it. For enterprises, enforce the minimum version via Group Policy (Windows) or mobile device management policies (iOS/Android/ChromeOS). Verify patch deployment before allowing affected devices to connect to untrusted networks.

Patch guidance

Update to Chrome 150.0.7871.47 or any later version in the stable channel. Visit chrome://settings/help to check your current version and trigger an immediate update check if needed. The browser will download and stage the patch, applying it at the next restart. For managed environments, configure auto-update policies and verify rollout across your fleet. No rollback or workarounds are available; patching is the only remediation.

Detection guidance

Monitor for Chrome version compliance using your asset inventory or endpoint detection tools. Check for installations below version 150.0.7871.47 via WMI queries (Windows) or package managers (Linux/macOS). Network-level detection of exploitation is difficult without detailed browser telemetry; focus on patching velocity and post-compromise indicators (unusual outbound connections from browser processes, credential theft, unauthorized access to internal web applications from previously-trusted user sessions).

Why prioritize this

This vulnerability is a remote code execution that requires only a malicious webpage to trigger. The lack of KEV status and limited active exploitation reports do not diminish urgency—the flaw is straightforward to exploit and affects a ubiquitous browser. Patch immediately, as the attack surface (any website a user visits) is enormous. If any user must use Chrome on systems with access to sensitive data or internal services, immediate patching is non-negotiable.

Risk score, explained

The CVSS 8.8 (High) score reflects remote network access, no authentication, user interaction limited to a single click or automatic page load, and high impact on confidentiality, integrity, and availability within the sandbox context. Chromium's internal Medium rating accounts for sandbox containment, but the overall score correctly emphasizes that sandbox escape is not required—full control of the renderer process is a severe outcome for sensitive workflows.

Frequently asked questions