CVE-2026-13797: Google Chrome RCE Vulnerability

CVE-2026-13797 Overview

CVE-2026-13797 is an input validation vulnerability in the Chromecast component of Google Chrome prior to version 150.0.7871.47. The flaw allows a remote attacker who has already compromised the renderer process to escape the Chrome sandbox using a crafted HTML page. Chromium rates the security severity as High, and the CVSS score of 9.6 reflects the cross-boundary impact of a successful exploit. The vulnerability is tracked under CWE-20: Improper Input Validation.

Critical Impact
Successful exploitation chains a renderer compromise with a sandbox escape, giving attackers code execution outside the browser sandbox on Windows, macOS, and Linux hosts.

Affected Products

Google Chrome prior to 150.0.7871.47
Chrome desktop builds on Microsoft Windows, Apple macOS, and Linux
Chromium-based downstream builds incorporating the vulnerable Chromecast component

Discovery Timeline

2026-06-30 - CVE-2026-13797 published to NVD
2026-07-02 - Last updated in NVD database
2026-06 - Google releases fixed build 150.0.7871.47 via the Stable Channel update for desktop

Technical Details for CVE-2026-13797

Vulnerability Analysis

The vulnerability resides in Chrome's Chromecast integration, which handles media casting between the browser and Cast-enabled receivers. Chromecast code paths accept structured input from the renderer process and act on that data in a higher-privileged browser or utility process. Insufficient validation of that untrusted input allows a compromised renderer to send malformed data that the receiving process mishandles.

Exploitation requires two conditions. First, an attacker must already control the renderer process, typically through a separate memory corruption bug triggered by a crafted HTML page. Second, the attacker must invoke the vulnerable Chromecast interface to cross the sandbox boundary. User interaction is required, consistent with visiting an attacker-controlled page. See the Chromium Issue Tracker Entry for the upstream record.

Root Cause

The root cause is improper validation of data supplied by the renderer to the Chromecast component, categorized as [CWE-20]. The privileged code path trusts fields or structures that the renderer can influence, enabling behavior the sandbox design was intended to prevent.

Attack Vector

The attack vector is network based and delivered through a crafted HTML page. An attacker chains a renderer exploit with the Chromecast flaw to break out of the sandbox and execute code with browser process privileges. No verified public proof-of-concept is available at publication.

// No verified proof-of-concept code has been published for CVE-2026-13797.
// Refer to the Chromium issue tracker for technical details once access is granted.

Detection Methods for CVE-2026-13797

Indicators of Compromise

Chrome browser processes spawning unexpected child processes such as command shells, script interpreters, or LOLBins immediately after visiting a new domain.
Chrome utility or GPU processes writing executables or persistence artifacts to user-writable paths.
Outbound connections to unfamiliar hosts initiated by Chrome shortly after rendering an untrusted page.

Detection Strategies

Inventory Chrome versions across the fleet and flag any host running a build below 150.0.7871.47.
Alert on Chrome renderer or utility processes performing behaviors outside their normal scope, such as file system writes to autostart locations or credential store access.
Correlate browser process crashes with subsequent process creation events, which can indicate a chained renderer plus sandbox escape attempt.

Monitoring Recommendations

Forward EDR process telemetry and Chrome crash reports into a centralized analytics platform for retrospective hunting.
Monitor DNS and proxy logs for user visits to newly registered or low-reputation domains preceding anomalous Chrome behavior.
Track Chromecast and media routing activity on endpoints that do not typically use casting features.

How to Mitigate CVE-2026-13797

Immediate Actions Required

Update Google Chrome to 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binary is loaded across all processes.
Audit Chromium-based applications and browsers for downstream patches that incorporate the Chromecast fix.

Patch Information

Google addressed CVE-2026-13797 in the Stable Channel desktop release documented in the Google Chrome Desktop Update. Administrators should confirm managed Chrome deployments have received the update through Google Update, enterprise MSI packaging, or configuration management tooling.

Workarounds

Enforce automatic Chrome updates through the ChromeCleanupEnabled and update policies in enterprise group policy or MDM.
Restrict browsing to trusted sites through URL allowlisting on high-value systems until patching completes.
Disable Chromecast and media routing via the EnableMediaRouter policy where casting is not required.

bash

# Example: disable Media Router via Chrome enterprise policy on Linux
sudo tee /etc/opt/chrome/policies/managed/disable_cast.json > /dev/null <<'EOF'
{
  "EnableMediaRouter": false,
  "MediaRouterCastAllowAllIPs": false
}
EOF