CVE-2026-13796: Google Chrome RCE Vulnerability

CVE-2026-13796 Overview

CVE-2026-13796 is an integer overflow vulnerability in the Chromecast component of Google Chrome prior to version 150.0.7871.47. A remote attacker who has already compromised the renderer process can leverage this flaw to escape the Chrome sandbox by serving a crafted HTML page. Google classifies the Chromium security severity as High, and the CVSS v3.1 score is 9.6. The weakness is tracked under CWE-472 and affects Chrome installations on Windows, macOS, and Linux. Successful exploitation breaks Chrome's primary security boundary and permits code execution outside the renderer.

Critical Impact
Sandbox escape from a compromised renderer, enabling arbitrary code execution on the host operating system through a crafted HTML page.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromecast component within the Chromium browser engine

Discovery Timeline

2026-06-30 - CVE-2026-13796 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13796

Vulnerability Analysis

The vulnerability is an integer overflow in the Chromecast subsystem of Chrome. Integer overflows occur when arithmetic operations produce a value that exceeds the storage capacity of the integer type. In this case, the overflow enables an attacker to influence downstream size calculations or memory operations within a higher-privileged Chrome process.

The attacker must first achieve code execution inside the renderer process, typically by chaining a separate renderer-level bug. From that position, they use the Chromecast integer overflow to cross the sandbox boundary and execute code in a process with broader system access. This two-stage pattern is standard for modern Chrome exploitation chains.

User interaction is required, since the victim must load a crafted HTML page. The scope change indicates that impact extends beyond the vulnerable component to affect the underlying host.

Root Cause

The root cause is an external control of a value used in arithmetic that is not properly bounds-checked before use, aligning with CWE-472. When attacker-influenced input feeds an unchecked size or index calculation in the Chromecast code path, the resulting wrapped value corrupts memory management logic. This corruption is the primitive used to escape the renderer sandbox.

Attack Vector

Exploitation proceeds over the network. An attacker hosts a malicious HTML page and lures the victim to visit it in a vulnerable Chrome build. After compromising the renderer, the attacker triggers the Chromecast code path to invoke the integer overflow and pivot into a sandboxed-escape primitive. Refer to the Chromium Issue Report and the Google Chrome Update Announcement for vendor detail.

Detection Methods for CVE-2026-13796

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, powershell.exe, or scripting hosts following visits to unknown web content.
Renderer or GPU process crashes correlated with Chromecast media routing activity in Chrome crash reports.
Outbound connections to attacker-controlled domains initiated by processes spawned from Chrome.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag any version below 150.0.7871.47 as vulnerable.
Monitor for anomalous process lineage where Chrome is the parent of non-browser binaries, which is a hallmark of sandbox escape follow-on activity.
Correlate browser exploitation attempts with EDR telemetry, including memory write anomalies inside Chrome processes.

Monitoring Recommendations

Ingest Chrome update posture and process telemetry into a central data lake for continuous version drift and behavioral analysis.
Alert on Chromecast-related crash signatures in application error logs across Windows, macOS, and Linux fleets.
Track web proxy logs for repeat visits to unclassified domains that immediately precede endpoint anomalies.

How to Mitigate CVE-2026-13796

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Force browser restart after deployment so the patched binaries load in every user session.
Verify enterprise Chrome update channels are set to the Stable channel and receiving policy updates.

Patch Information

Google addressed CVE-2026-13796 in the Stable channel release documented in the Google Chrome Update Announcement. The fix ships in Chrome 150.0.7871.47 for desktop platforms. Chromium-based browsers that consume upstream patches should be upgraded once their vendors publish the corresponding builds.

Workarounds

Restrict user browsing to trusted destinations through web filtering while patch deployment is in progress.
Disable or block the Chromecast media routing feature through enterprise policy where business requirements permit.
Enforce site isolation and strict sandboxing policies to raise the cost of chaining a renderer bug with this sandbox escape.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed Chrome build via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read Chrome bundle version
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString