CVE-2026-13977: Chrome HTMLParser XSS Vulnerability – Patch Now

Technical summary

CVE-2026-13977 is a cross-site scripting (XSS) vulnerability—specifically an unauthorized/unexpected XSS (UXSS)—in Chromium's HTMLParser component. The flaw stems from improper input validation or output encoding during HTML parsing, allowing an attacker to bypass the browser's same-origin policy or security boundaries. An attacker-controlled HTML document can be crafted to inject scripts that execute in a security context where they should be blocked. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Chromium rated this as Medium severity due to the requirement for user interaction and limited scope of impact per individual session.

Business impact

Organizations face direct risk if employees use affected Chrome versions to access internal or external web applications. Attackers could steal session cookies, harvest login credentials, or perform unauthorized actions within authenticated sessions. In enterprise environments where Chrome is the standard browser, a widespread attack could compromise multiple employee accounts simultaneously. Third-party web applications hosted on internal networks may also become attack vectors if accessed through vulnerable Chrome versions. The user-interaction requirement (visiting a malicious page) somewhat limits spontaneous, mass-scale exploitation, but targeted social engineering remains viable.

Affected systems

Any system running Google Chrome prior to version 150.0.7871.47 is affected. This includes Windows, macOS, and Linux desktop installations, as well as Chrome on mobile platforms if applicable to version numbering. Organizations should audit deployed Chrome versions across corporate environments, including managed Chromebooks if present. Unmanaged personal devices used for work may also be at risk if users have not updated automatically.

Exploitability

Exploitation requires a remote attacker to craft a malicious HTML page and trick a user into visiting it—via phishing email, watering hole attack, or malicious advertisement. The attack surface is broad because any website or domain could theoretically be used as a delivery mechanism. No special network conditions, authentication, or elevated privileges are needed on the attacker side. However, the attack does depend on user action (opening the link), which provides a small friction barrier. Practical exploitation difficulty is low; proof-of-concept code would be straightforward, though none has been publicly disclosed. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the current date.

Remediation

Update Google Chrome to version 150.0.7871.47 or later immediately. Chrome's auto-update mechanism will push the patched version to most users, but verification is recommended. Users should manually check Chrome's version via Settings > About Chrome to confirm the update has been applied. Enterprise administrators managing Chrome deployments should verify that managed devices have received the patch through their mobile device management (MDM) or group policy configurations. No workarounds exist; patching is the only mitigation.

Patch guidance

Google released the fix in Chrome 150.0.7871.47. Apply this version or any subsequent stable release. For Enterprise customers using Chrome Enterprise, check your update cadence and policy settings to ensure the patch is deployed. If using a deferred update channel, expedite the release to production given the XSS risk profile. Verify patch deployment by sampling a subset of managed devices and confirming version numbers in your browser management console.

Detection guidance

Monitor network traffic for signs of exploitation: unusual POST requests to credential-harvesting domains, unexpected JavaScript execution in browser console logs (if available), or users reporting suspicious browser behavior after visiting unfamiliar links. Endpoint detection and response (EDR) tools may flag suspicious script execution tied to Chrome processes. Log browser version compliance through your mobile device management or asset management tool to identify unpatched instances. User reports of unexpected page behavior or unwanted dialogs may indicate exploitation attempts. Correlate user activity logs with known malicious domain lists to identify if users accessed attacker-controlled pages.

Why prioritize this

Although the CVSS score is 5.4 (Medium), this vulnerability warrants prompt attention due to Chrome's ubiquity in enterprise environments, the ease of exploitation via social engineering, and the risk of credential compromise. XSS flaws are well-understood and commonly chained with other attacks. The lack of KEV designation suggests active, large-scale exploitation is not yet documented, providing a window to patch before threat actors develop or deploy weaponized attacks. Prioritize based on your organization's Chrome footprint and the sensitivity of data accessible through employee browsers.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction necessary (UI:R). The scope is unchanged (S:U), and impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact (A:N). The Medium severity aligns with the fact that while the vulnerability is easily triggered, its blast radius per attack is confined to the user's own session and does not compromise the entire browser or system. In context of widespread Chrome deployment, aggregate organizational risk is higher than the individual score suggests.

Frequently asked questions