CVE-2026-13975: Chrome ANGLE Out-of-Bounds Read on macOS – Patch Guidance

Technical summary

CVE-2026-13975 is an out-of-bounds read vulnerability in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Chrome. The vulnerability exists in Chrome versions prior to 150.0.7871.47 on macOS. An attacker who has already achieved renderer process compromise can craft a specially designed HTML page that triggers an out-of-bounds memory read operation. This allows reading of memory contents that should not be accessible, potentially exposing confidential data from the process's memory space. The issue is classified as a logic error (CWE-125: Out-of-bounds Read) in the graphics rendering pipeline.

Business impact

The practical business impact is constrained by the requirement that the renderer process must already be compromised before this vulnerability can be exploited. This positions it as a post-compromise persistence or information exfiltration vector rather than a direct attack vector. Organizations should evaluate whether their threat model includes sophisticated attackers who combine multiple vulnerabilities—one to breach the renderer, then this vulnerability to extract credentials or sensitive data. For most organizations, the risk is moderate unless handling particularly sensitive workloads in Chrome, or operating in high-threat environments where multi-stage attacks are expected.

Affected systems

Google Chrome on Apple macOS systems running versions prior to 150.0.7871.47 are affected. The vulnerability is specific to the macOS implementation of ANGLE graphics. Chrome users on Windows and Linux are not affected by this particular issue. All macOS users of Chrome should verify they are running the patched version. Enterprise deployments managing Chrome on macOS fleets should prioritize upgrades to the latest stable release.

Exploitability

Exploitation requires a specific precondition: the renderer process must already be compromised through another means. An attacker cannot exploit this vulnerability via a simple malicious web page alone; they must first establish renderer compromise. The attack vector is network-based (the malicious HTML page is delivered over the network), but requires user interaction (the user must visit the page while the renderer is compromised). The CVSS score of 5.3 (Medium) reflects the high impact if exploited (confidentiality breach) tempered by the difficult preconditions and lack of direct integrity or availability impact. This is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no widespread active exploitation has been observed.

Remediation

Update Google Chrome to version 150.0.7871.47 or later on all macOS systems. Users can verify their Chrome version by navigating to Chrome menu > About Google Chrome, which will automatically check for updates and apply them after restart. For organizations with managed Chrome deployments, push the update through your standard Chrome update management channel or endpoint management platform. No workarounds are available for systems that cannot be updated immediately; users should avoid visiting untrusted websites while awaiting patches.

Patch guidance

The patch is available in Chrome version 150.0.7871.47 and later. To apply the update: (1) Users should ensure Chrome is set to auto-update, which is the default; (2) Manual update is available via Chrome menu > About Google Chrome; (3) The update will take effect after Chrome is fully closed and restarted; (4) Enterprise administrators should verify deployment through their MDM or Chrome management console and confirm the new version is installed across their fleet before considering the vulnerability remediated. Verify against the official Google Chrome release notes that your deployed version is indeed 150.0.7871.47 or later.

Detection guidance

Detection of exploitation attempts is challenging because the attack requires prior renderer compromise and operates at the memory level rather than through observable network signatures. Recommendations: (1) Monitor for out-of-date Chrome versions in your organization using endpoint detection or inventory tools, and flag any systems still running pre-150.0.7871.47; (2) Use behavioral analytics to identify Chrome processes exhibiting unusual memory access patterns or rendering anomalies; (3) Endpoint detection and response (EDR) tools should flag suspicious child processes spawned by Chrome or unusual inter-process communication; (4) If you suspect active exploitation, review Chrome renderer process crashes or memory corruption errors in system logs, though these may not be definitive indicators.

Why prioritize this

This vulnerability should be prioritized based on your organization's Chrome deployment scale and security posture. Prioritize higher if: (1) you have strict confidentiality requirements and Chrome handles sensitive data; (2) you operate in a high-threat environment where multi-stage attacks are realistic; (3) you have significant user populations on macOS. Prioritize lower if: (1) your Chrome deployments are ephemeral or non-sensitive; (2) your threat model does not include sophisticated multi-stage attacks; (3) you have rapid patch deployment infrastructure. Given that CISA has not flagged this for exploitation and it requires renderer compromise, it is not a critical emergency, but should be included in your regular patching cycle with higher priority than standard quarterly updates.

Risk score, explained

The CVSS score of 5.3 reflects a Medium severity assessment. The score accounts for: high confidentiality impact (reading sensitive memory), no integrity or availability impact, requirement for user interaction, and high attack complexity (due to the renderer compromise precondition). The attack vector is network-based, but cannot succeed in isolation—an attacker must first achieve renderer compromise through another vulnerability or attack method. This positions it as a secondary exploitation vector rather than a primary attack surface, justifying the Medium rather than High classification.

Frequently asked questions