CVE-2026-13791: Google Chrome RCE Vulnerability

CVE-2026-13791 Overview

CVE-2026-13791 is an input validation vulnerability in the Downloads component of Google Chrome. Versions prior to 150.0.7871.47 fail to properly validate untrusted input processed through the download subsystem. An attacker who convinces a user to install a malicious Chrome Extension can execute arbitrary code on the target system. The flaw affects Chrome across Windows, macOS, and Linux desktop platforms. Google's Chromium security team rated the underlying issue as High severity. The weakness maps to [CWE-20] Improper Input Validation.

Critical Impact
Successful exploitation enables arbitrary code execution on the victim's device through a crafted Chrome Extension abusing the Downloads component.

Affected Products

Google Chrome prior to 150.0.7871.47
Microsoft Windows desktop installations of Chrome
Apple macOS and Linux desktop installations of Chrome

Discovery Timeline

2026-06-30 - CVE-2026-13791 published to the National Vulnerability Database (NVD)
2026-07-02 - Last updated in the NVD database

Technical Details for CVE-2026-13791

Vulnerability Analysis

The vulnerability resides in the Downloads component of Google Chrome. The component accepts input paths from extension APIs without adequate validation of untrusted values. A malicious Chrome Extension can supply crafted parameters that the Downloads code processes without sanitization. This chain results in arbitrary code execution within the context of the browser user. The attack requires user interaction to install the malicious extension, but no further privileges once the extension is loaded. Because Chrome operates with the privileges of the interactive user, successful exploitation grants attackers access to user files, session tokens, and installed applications.

Root Cause

The root cause is improper input validation [CWE-20] in the Downloads code path. Data received from an extension crosses a trust boundary without being normalized, canonicalized, or checked against an allowlist. This gap allows extension-supplied fields to influence privileged download operations. The result is an attacker-controlled state that the browser treats as trusted.

Attack Vector

Exploitation is network-based but requires the victim to install a crafted Chrome Extension. Attackers typically distribute malicious extensions through phishing pages, sideloaded packages, or compromised third-party stores. Once installed, the extension invokes the Downloads API with malicious parameters designed to trigger the flaw. No additional authentication is required, and the exploit runs with the user's browser privileges. The attack complexity is High because the attacker must convince a user to install and enable the extension.

No public proof-of-concept or exploit code is available for CVE-2026-13791. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13791

Indicators of Compromise

Unexpected entries in the Chrome extensions directory (chrome.google.com/webstore installations outside of approved IDs)
Chrome child processes spawning shells, scripting engines, or rundll32.exe immediately after a download event
Files written to unusual paths by Chrome, such as startup folders or user profile roots
Extensions requesting the downloads permission from unknown or newly published publishers

Detection Strategies

Inventory installed Chrome extensions across the fleet and compare against an approved allowlist
Alert on process lineage where chrome.exe (or the platform equivalent) launches non-browser binaries following download activity
Correlate extension installation events with subsequent file writes to sensitive directories

Monitoring Recommendations

Ingest Chrome extension telemetry and enterprise policy events into a centralized SIEM for review
Track the browser version deployed on each endpoint and flag any host running a Chrome build below 150.0.7871.47
Monitor egress traffic from browser processes to newly registered or low-reputation domains

How to Mitigate CVE-2026-13791

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Audit installed extensions and remove any that are unsanctioned, unsigned, or unnecessary
Restrict extension installation to an administrator-approved allowlist using enterprise policy

Patch Information

Google addressed CVE-2026-13791 in the Chrome Stable channel release 150.0.7871.47. Refer to the Google Chrome Desktop Update for release details and the Chromium Issue Tracker Entry for the underlying bug record. Apply the update through managed software distribution or by enabling Chrome's built-in auto-update mechanism.

Workarounds

Enforce the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies to prevent sideloading of untrusted extensions
Disable developer mode extensions on managed browsers using the DeveloperToolsAvailability policy
Educate users on the risks of installing extensions from links or third-party sources outside the Chrome Web Store

bash

# Example Chrome enterprise policy on Linux to block all extensions except an approved list
sudo tee /etc/opt/chrome/policies/managed/extension_policy.json > /dev/null <<'EOF'
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "aapocclcgogkmnckokdopfmhonfmgoek",
    "ghbmnnjooekpmoecnnnilnnbdlolhkhi"
  ],
  "DeveloperToolsAvailability": 2
}
EOF