CVE-2026-13967: Chrome V8 Heap Overflow RCE – Patch Now

Technical summary

CVE-2026-13967 is a heap buffer overflow in the V8 JavaScript engine integrated into Google Chrome. The flaw exists in versions prior to 150.0.7871.47 and stems from improper bounds checking during memory operations, allowing an attacker to overflow the heap and corrupt adjacent memory structures. The CWE-843 classification indicates a type confusion or unsafe polymorphism issue in the engine's memory handling. An attacker crafts a malicious HTML page that triggers the overflow condition when parsed and executed by V8, resulting in arbitrary code execution within Chrome's sandbox environment. The attack vector is network-based with no privilege requirements, but user interaction is necessary—the victim must visit the attacker-controlled or compromised website.

Business impact

Successful exploitation could enable credential theft, data exfiltration, and malware installation on affected systems. Users who browse to a malicious site could have their browsing history, cached passwords, site data, and other sensitive information accessed by an attacker. In enterprise environments, this could facilitate targeted attacks against employees and compromise internal security by allowing attackers to pivot from the browser sandbox to other network resources or exploit additional vulnerabilities in the host operating system. The requirement for user interaction means security teams cannot rely on passive protection alone.

Affected systems

All versions of Google Chrome prior to 150.0.7871.47 are vulnerable. This includes Chrome on Windows, macOS, Linux, Android, and iOS, though the technical specifics of exploitation may vary by platform. Enterprise deployments using managed Chrome instances or Chromium-based alternatives (Edge, Brave, etc. if they incorporate the vulnerable V8 version) may also be affected depending on their update cadence and version lag.

Exploitability

The vulnerability has a low barrier to exploitation in terms of technical skill. Once a working exploit is developed, delivering it requires only hosting a malicious webpage and directing users to it—tactics that are well within the capability of moderately sophisticated threat actors. Social engineering, malvertising, or watering-hole attacks could be used to lure victims. The user interaction requirement—visiting a webpage—is a common behavior, making mass exploitation feasible. However, there is no evidence of in-the-wild exploitation at this time, as the vulnerability was only recently published.

Remediation

Users and administrators must update Google Chrome to version 150.0.7871.47 or later. Chrome typically auto-updates on desktop platforms, but organizations should verify that updates have been applied, particularly in air-gapped or controlled environments. For managed deployments, ensure that update policies are not blocking the patch or delaying rollout. Users on older OS versions that no longer receive Chrome updates should consider upgrading their operating system or migrating to a supported browser.

Patch guidance

Verify that your Chrome installations are running version 150.0.7871.47 or later. On Windows, macOS, and Linux, check Help > About Google Chrome; the browser will auto-update and prompt for restart if a newer version is available. On Android, check the Google Play Store for Chrome updates. Enterprise administrators should check their device management console (Google Admin Console, Microsoft Intune, etc.) to confirm patch deployment status. If auto-update is disabled in your environment, manually trigger updates or adjust group policies to enable them. Test the patch in a non-production environment first if your organization has stringent change control processes.

Detection guidance

Monitor Chrome process execution and memory behavior for unusual patterns, though detecting exploitation in real-time is difficult without EDR tooling. Look for unexpected child processes spawned from Chrome, unusual network connections initiated after visiting unfamiliar sites, and browser crashes followed by suspicious activity. Web application firewalls and URL filtering can reduce exposure by blocking known malicious domains. Security teams should track which employees have not yet updated to the patched version and prioritize user awareness training to discourage visits to untrusted sites. Review browser security policies to enable additional sandboxing features if available.

Why prioritize this

This vulnerability merits immediate patching despite the lack of KEV status. The combination of a high CVSS score (8.8), network attack surface, and code execution capability makes it a top priority. Although user interaction is required, this is a low bar in practice—billions of web pages are visited daily. The Medium Chromium severity rating suggests Google's own assessment recognizes the risk but may reflect the sandbox containment; the CVSS score reflects the true impact if exploitation occurs. Early patching reduces the window in which threat actors can weaponize the flaw.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a HIGH-severity vulnerability due to the attack vector being network-based with low complexity, no privilege requirements, and user interaction. The impact is High across confidentiality, integrity, and availability because code execution within the sandbox can lead to data theft and system compromise. The sandbox itself does not lower the CVSS score because the scope is unchanged—an attacker still executes code in the context of the Chrome process and can exfiltrate data, modify cached content, and potentially trigger additional vulnerabilities. The score does not account for the practical difficulty of exploitation or the lack of current in-the-wild exploitation, which may justify accelerated patching beyond standard CVSS guidance.

Frequently asked questions