CVE-2026-13974: Chrome Safe Browsing Integer Overflow on macOS (CVSS 8.1)

Technical summary

CVE-2026-13974 is an integer overflow vulnerability (CWE-472) within Chrome's Safe Browsing subsystem on macOS. Integer overflows occur when arithmetic operations exceed the maximum value a variable can hold, causing it to wrap around to an unexpected value. In this case, the flaw permits an attacker to craft a specially formed file that, when processed by the Safe Browsing checker, causes an integer overflow that defeats the navigation restriction mechanisms. The issue does not require prior authentication or elevated privileges, but does require user interaction to open or download the malicious file. Chrome's Chromium project rated this as Medium severity internally, though the CVSS 3.1 score of 8.1 reflects the high integrity and availability impact potential.

Business impact

Safe Browsing is a core protection mechanism that prevents users from visiting malicious websites and downloading harmful files. Bypassing these restrictions exposes users to phishing, malware distribution, and other web-based attacks. For organizations using Chrome as a managed browser, this vulnerability could allow attackers to redirect users to credential-harvesting sites or deliver malware despite browser-level protections. The integrity and availability impacts suggest that successful exploitation could corrupt browsing state or crash the browser process, affecting user productivity and potentially enabling further system compromise.

Affected systems

Google Chrome on Apple macOS systems running versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the macOS platform; Chrome on Windows and Linux are not mentioned in the advisory. Organizations should verify their macOS deployment versions and patch status, particularly in environments where macOS is the primary or supplementary endpoint platform.

Exploitability

The vulnerability has a low attack complexity and requires no special privileges, making it straightforward for an attacker to craft a malicious file. However, exploitation depends on user interaction—the user must download or open the malicious file. This places it in a typical web-based attack scenario: a user receives a phishing email or visits a compromised site and is prompted to download a file. Once the file is opened in Chrome or associated with Chrome for Safe Browsing processing, the integer overflow is triggered. The attack vector is network-based, so remote delivery is feasible. The vulnerability is not currently tracked in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating no confirmed active exploitation in the wild at the time of publication.

Remediation

Update Google Chrome on macOS to version 150.0.7871.47 or later. Users can check their Chrome version by clicking the menu icon (three horizontal lines), selecting 'About Google Chrome,' and allowing the browser to download and install updates automatically. Administrators managing Chrome through Mobile Device Management (MDM) or organizational policies should verify that auto-update is enabled and push the latest version to all macOS endpoints. For air-gapped or manually managed systems, download the latest Chrome installer from the official Google Chrome website.

Patch guidance

Google has released Chrome version 150.0.7871.47 to address this vulnerability. Verify the installed version through 'Chrome menu > About Google Chrome' or programmatically via your endpoint management solution. Auto-update is the default behavior in Chrome; if disabled in your environment, manually trigger updates. For macOS deployments using organizational policies, confirm that the minimum required version is set to 150.0.7871.47 or higher. Testing in a pilot group of users before full rollout is recommended to identify any compatibility issues with internal web applications.

Detection guidance

Monitor Chrome version inventory across your macOS fleet using endpoint detection and response (EDR) tools or MDM solutions that report installed application versions. Set alerts for instances of Chrome running versions below 150.0.7871.47 on macOS. While the integer overflow itself may not be easily detected in network traffic without deep packet inspection, behavioral indicators include unusual Safe Browsing cache corruption, browser crashes related to navigation processing, or users bypassing expected phishing/malware warnings. Review browser crash logs for stack traces mentioning the Safe Browsing module. Consider enabling Chrome's built-in security event logging if your organization has access to Chrome Enterprise audit features.

Why prioritize this

This vulnerability merits prompt patching despite the absence of confirmed active exploitation. The CVSS 8.1 HIGH score, combined with ease of exploitation and the fundamental importance of Safe Browsing as a security boundary, places it in the upper tier of patch priority. The requirement for user interaction does not significantly reduce risk in practice, as users routinely download files and social engineering is effective. The availability impact (browser crashes) and integrity impact (bypassed safety checks) both have operational consequences. Any macOS-heavy organization should prioritize this patch within one to two weeks.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects: (1) Network-based attack vector requiring no special access; (2) Low attack complexity—the malicious file is straightforward to create; (3) User interaction required, which prevents automatic compromise but does not eliminate practical risk; (4) Scope unchanged—impact is limited to the user's Chrome instance; (5) No confidentiality impact; (6) High integrity impact—Safe Browsing protections can be bypassed, allowing malicious content to reach the user; (7) High availability impact—integer overflow can cause a crash or process hang. The internal Chromium 'Medium' severity designation appears conservative relative to the CVSS 8.1, likely reflecting Chromium's broader attack surface considerations and lower prevalence of macOS-specific exploits. In a typical enterprise context, the CVSS score is the more appropriate guide for risk prioritization.

Frequently asked questions