CVE-2026-13784: Google Chrome Use After Free Vulnerability

CVE-2026-13784 Overview

CVE-2026-13784 is a use-after-free vulnerability in the Views component of Google Chrome prior to version 150.0.7871.47. A remote attacker who convinces a user to perform specific UI gestures can trigger heap corruption via a crafted HTML page. Chromium classifies the security severity as Critical, while the CVSS 3.1 score is 8.8. The flaw affects Chrome on Windows, macOS, and Linux. Exploitation requires user interaction but no authentication, and successful attacks can compromise confidentiality, integrity, and availability of the affected system. Google patched the issue in the Stable channel update for Desktop.

Critical Impact
Remote attackers can achieve heap corruption and potential code execution in the browser process by luring users to malicious web pages and prompting specific UI interactions.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux distributions
Chromium-based browsers that incorporate the vulnerable Views component

Discovery Timeline

2026-06-30 - CVE-2026-13784 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13784

Vulnerability Analysis

The flaw is a use-after-free condition [CWE-416] in Chrome's Views subsystem, which handles UI widgets, windows, and rendering primitives across desktop platforms. Use-after-free defects occur when code continues to reference memory after it has been released back to the allocator. An attacker who reclaims that freed region with attacker-controlled data can steer program execution or corrupt adjacent heap structures.

Because Views executes in the browser process rather than the sandboxed renderer, successful exploitation carries higher impact than typical renderer bugs. The EPSS probability is 0.314%, placing this issue in the 23rd percentile for near-term exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Root Cause

The root cause resides in object lifetime management inside the Views component. A UI object is destroyed while another code path retains a dangling pointer to it. When that stale reference is later dereferenced, the allocator may have already reused the memory for an unrelated object, producing heap corruption. See Chromium Issue #516962715 for tracking details.

Attack Vector

Exploitation begins with a crafted HTML page delivered over the network. The attacker must persuade the victim to perform specific UI gestures, such as clicking, dragging, or interacting with a prompt, that trigger the vulnerable code path. Once the freed object is dereferenced, heap corruption can be leveraged for arbitrary read/write primitives and ultimately code execution in the browser process.

No verified exploit code is publicly available. Refer to the Chromium security advisory for vendor guidance.

Detection Methods for CVE-2026-13784

Indicators of Compromise

Chrome browser processes crashing with heap corruption signatures shortly after loading untrusted web content
Outbound connections from Chrome to newly registered or low-reputation domains delivering HTML payloads
Unexpected child processes spawned by chrome.exe following user interaction with a web page
Endpoint telemetry showing Chrome versions below 150.0.7871.47 in the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 150.0.7871.47
Monitor browser crash dumps for use-after-free indicators in Views-related modules
Correlate suspicious HTML delivery with subsequent Chrome process anomalies via EDR telemetry

Monitoring Recommendations

Enable browser telemetry and crash reporting to a central collector for triage
Alert on Chrome processes performing unusual file writes, registry changes, or network callbacks
Track patch compliance in configuration management tooling and set thresholds for out-of-date browsers

How to Mitigate CVE-2026-13784

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on Windows, macOS, and Linux endpoints
Restart Chrome after applying the update so the patched binaries load into memory
Audit Chromium-based browsers such as Edge, Brave, and Opera for corresponding vendor updates
Communicate the risk of unsolicited UI prompts and drag-and-drop interactions on unfamiliar sites to users

Patch Information

Google released the fix in the Stable channel update for Desktop. See the Google Chrome Stable Update advisory for full version details and rollout guidance. Enterprises managing Chrome via policy should force the update through Google Update, Chrome Browser Cloud Management, or an equivalent deployment tool.

Workarounds

Restrict browsing to trusted sites via web filtering or SWG policies until patching completes
Disable or restrict Chrome extensions that automate UI interactions on untrusted pages
Enforce site isolation and enhanced Safe Browsing through enterprise policy

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv