CVE-2026-13779: Google Chrome Use After Free Vulnerability

CVE-2026-13779 Overview

CVE-2026-13779 is a use-after-free vulnerability in the Chromoting component of Google Chrome on ChromeOS. The flaw affects Chrome versions prior to 150.0.7871.47 and enables remote attackers to execute arbitrary code by sending malicious network traffic to a targeted device. Chromium engineers rated the underlying issue as Critical severity, while the NVD assigns a CVSS 3.1 base score of 8.1 (High). The weakness maps to [CWE-416: Use After Free]. Chromoting is the Chrome Remote Desktop subsystem, meaning exploitation targets a code path exposed to remote network peers. Successful exploitation gives attackers code execution within the Chrome process context on ChromeOS endpoints.

Critical Impact
Remote attackers can execute arbitrary code on ChromeOS devices running vulnerable Chrome builds by delivering crafted network traffic to the Chromoting component.

Affected Products

Google Chrome on ChromeOS prior to 150.0.7871.47
Google ChromeOS devices running affected Chrome builds
Chrome Remote Desktop (Chromoting) sessions on vulnerable hosts

Discovery Timeline

2026-06-30 - CVE-2026-13779 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13779

Vulnerability Analysis

The vulnerability resides in Chromoting, the component that implements Chrome Remote Desktop functionality on ChromeOS. A use-after-free condition occurs when the component references heap memory that was previously released. Because Chromoting processes remote network traffic during session establishment and data transfer, an attacker can trigger the dangling reference from outside the target network boundary. Execution of arbitrary code follows once the attacker controls the freed allocation and its subsequent reuse. The bug carries [CWE-416] classification and is tracked in the Chromium issue tracker under entry 513222854. Public exploit code is not currently available, and CISA has not added the entry to the Known Exploited Vulnerabilities catalog. EPSS scoring places exploitation probability at a low but non-zero level as of the publication window.

Root Cause

The root cause is improper lifetime management of an object handled by Chromoting. Code paths continue to dereference a pointer after the underlying object has been freed, permitting attacker-controlled data to occupy the reclaimed slot. When the stale pointer is next used, attacker data drives program flow. Chromoting's exposure to remote peers converts what is often a local memory-safety bug into a network-reachable code execution primitive.

Attack Vector

Exploitation requires network access to a vulnerable ChromeOS device that has Chromoting reachable, and the attacker must send crafted traffic that triggers the free-then-reuse sequence. The CVSS vector indicates high attack complexity, so exploitation depends on winning timing or state conditions inside the Chromoting session lifecycle. No authentication or user interaction is required, and successful exploitation impacts confidentiality, integrity, and availability of the Chrome process. Verified proof-of-concept code has not been published at the time of writing. Refer to the Chromium Issue Tracker Entry for available technical detail as it is disclosed.

Detection Methods for CVE-2026-13779

Indicators of Compromise

Unexpected Chromoting or Chrome Remote Desktop network sessions originating from untrusted peers.
Chrome process crashes or renderer termination events on ChromeOS coinciding with inbound Chromoting traffic.
Anomalous outbound connections from Chrome processes shortly after remote desktop session negotiation.

Detection Strategies

Inventory ChromeOS endpoints and identify Chrome versions below 150.0.7871.47 using management console reporting.
Monitor network traffic for Chromoting protocol activity from unexpected sources or geographies.
Alert on Chrome process spawning shell utilities, scripting hosts, or making unusual system calls after remote desktop connections.

Monitoring Recommendations

Enable enterprise ChromeOS reporting and forward Chrome crash telemetry to a centralized log store for retrospective analysis.
Correlate Chromoting session logs with endpoint process telemetry to detect exploitation attempts across the fleet.
Track vendor advisories from the Google Chrome Release Update for follow-on fixes or related disclosures.

How to Mitigate CVE-2026-13779

Immediate Actions Required

Update Google Chrome on ChromeOS to version 150.0.7871.47 or later across all managed devices.
Force ChromeOS device restarts to complete the update where auto-update has staged but not applied the fix.
Disable Chrome Remote Desktop on devices that do not require the capability until patching is confirmed.

Patch Information

Google addressed the vulnerability in Chrome 150.0.7871.47 on the stable channel. Deployment details are documented in the Google Chrome Release Update. Administrators managing ChromeOS through the Google Admin console should verify that the target version policy is set to the fixed release and audit non-compliant devices.

Workarounds

Restrict inbound network access to Chromoting listeners using host or network-level firewalls.
Disable Chrome Remote Desktop policy (RemoteAccessHostFirewallTraversal, RemoteAccessHostAllowRemoteAccessConnections) through enterprise policy where remote desktop functionality is not required.
Segment ChromeOS devices from untrusted networks to reduce exposure until patches are applied.

bash

# Enterprise policy example: disable Chrome Remote Desktop host connections
# Applied via Google Admin console > Devices > Chrome > Settings > User & browser settings
RemoteAccessHostAllowRemoteAccessConnections: false
RemoteAccessHostFirewallTraversal: false

# Verify Chrome version on a ChromeOS device (chrome://version)
# Ensure the reported version is >= 150.0.7871.47