CVE-2026-13775: Google Chrome Use After Free Vulnerability

CVE-2026-13775 Overview

CVE-2026-13775 is a use-after-free vulnerability [CWE-416] in the GPU component of Google Chrome prior to version 150.0.7871.47. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to potentially escape the Chrome sandbox. Chromium rates the security severity as Critical. The flaw affects Chrome across Windows, macOS, and Linux. Because sandbox escape delivers attacker code into a higher-privilege process, this vulnerability is a viable second stage for browser exploit chains.

Critical Impact
Successful exploitation allows a compromised renderer to break out of the Chrome sandbox and execute code in the GPU process context, enabling further compromise of the host system.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based downstream browsers that ship the vulnerable GPU code

Discovery Timeline

2026-06-30 - CVE-2026-13775 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13775

Vulnerability Analysis

The vulnerability is a use-after-free condition in Chrome's GPU process. The GPU process handles graphics acceleration requests, including WebGL, WebGPU, and canvas rendering, on behalf of renderer processes. When the GPU process frees an object but retains a dangling pointer, subsequent access to that pointer produces undefined behavior that attackers can shape into arbitrary read, write, or control-flow primitives.

Exploitation requires an attacker to first compromise the renderer process, typically through a separate memory corruption bug reachable from JavaScript. From that foothold, the attacker issues crafted GPU commands over the Chrome IPC boundary to trigger the free and then reuse the stale reference. Success promotes code execution from the sandboxed renderer into the less-restricted GPU process.

Root Cause

The root cause is improper object lifetime management inside a GPU-side handler. A reference is released while another code path still holds a raw pointer to the same allocation. Rust-style ownership rules are not enforced across this boundary, so the compiler cannot statically prevent the reuse. The condition maps to [CWE-416] Use After Free.

Attack Vector

The vector is network reachable. A victim visits an attacker-controlled or compromised page, and the page delivers a renderer-side exploit followed by GPU IPC messages that trigger the free-then-reuse pattern. No user interaction beyond navigation is required.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor technical details. No public proof-of-concept has been released.

Detection Methods for CVE-2026-13775

Indicators of Compromise

Unexpected crashes of the gpu-process child of chrome.exe, Google Chrome Helper (GPU), or chrome --type=gpu-process with access-violation or SIGSEGV signatures
Chrome GPU process spawning child processes such as cmd.exe, powershell.exe, bash, or osascript
Outbound network connections originating from the Chrome GPU process to non-Google infrastructure
Endpoint versions of Chrome reporting a build earlier than 150.0.7871.47 after the patch release

Detection Strategies

Alert on process-lineage anomalies where the Chrome GPU process is the parent of a shell, scripting host, or LOLBin
Hunt for Chrome renderer or GPU processes writing executables or scripts to user-writable directories such as %TEMP%, ~/Library/Caches, or /tmp
Deploy browser inventory queries to surface hosts running Chrome builds below 150.0.7871.47

Monitoring Recommendations

Ingest Chrome crash telemetry and correlate GPU-process crashes with subsequent process creation events on the same host
Monitor for exploit-adjacent behavior chains, such as renderer crash followed by GPU crash followed by anomalous child processes
Track EDR alerts tagged to CWE-416 or sandbox-escape patterns on browser processes

How to Mitigate CVE-2026-13775

Immediate Actions Required

Update Google Chrome to 150.0.7871.47 or later on Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched binaries are loaded across all renderer and GPU processes
Push the update to Chromium-based browsers once their upstream builds incorporate the fix
Verify managed deployments through enterprise policy or MDM to confirm the patched version is installed

Patch Information

Google addressed the issue in the Chrome Stable channel at version 150.0.7871.47. Details are published in the Google Chrome Update Announcement. Enterprise administrators should validate rollout through Chrome Browser Cloud Management or equivalent policy tooling.

Workarounds

Disable hardware acceleration in Chrome via chrome://settings to reduce GPU-process attack surface until patching completes
Enforce site isolation and strict origin isolation policies to constrain renderer compromise
Restrict browsing on high-value hosts to trusted sites using URL allow-listing until the update is deployed

bash

# Enterprise policy example: disable hardware acceleration temporarily
# Windows (Group Policy registry key)
reg add "HKLM\Software\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f

# macOS (managed preference)
defaults write com.google.Chrome HardwareAccelerationModeEnabled -bool false

# Linux (policy JSON)
echo '{ "HardwareAccelerationModeEnabled": false }' | sudo tee /etc/opt/chrome/policies/managed/disable_gpu.json