CVE-2026-13801: Google Chrome RCE Vulnerability

CVE-2026-13801 Overview

CVE-2026-13801 is an integer overflow vulnerability in the Chromecast component of Google Chrome versions prior to 150.0.7871.47. The flaw allows a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page. Chromium classifies the severity as High, and the issue is tracked under CWE-472 (External Control of Assumed-Immutable Web Parameter). The vulnerability affects Chrome installations on Windows, macOS, and Linux. Google has addressed the issue in the stable channel update for desktop.

Critical Impact
Successful exploitation chains this flaw with a prior renderer compromise to escape the Chrome sandbox, enabling code execution outside the browser's constrained context.

Affected Products

Google Chrome prior to 150.0.7871.47
Chrome desktop builds on Microsoft Windows
Chrome desktop builds on Apple macOS and Linux

Discovery Timeline

2026-06-30 - CVE-2026-13801 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13801

Vulnerability Analysis

The vulnerability resides in the Chromecast component of Google Chrome. An integer overflow occurs when arithmetic on media or streaming metadata exceeds the storage limits of the underlying integer type. This wraparound produces incorrect size or offset values that downstream code trusts, leading to memory corruption conditions usable for a sandbox escape.

The issue is categorized under [CWE-472], reflecting improper handling of parameters that the browser assumes remain within bounded ranges. An attacker cannot trigger this flaw directly from an unprivileged web origin. Exploitation requires prior compromise of the renderer process, typically achieved by chaining a separate renderer-side bug.

Once the renderer is under attacker control, a crafted HTML page delivers inputs to the Chromecast code path that trigger the overflow. The corrupted state then enables the attacker to break out of the sandbox and execute code in the higher-privileged browser process context.

Root Cause

The root cause is unchecked arithmetic in Chromecast-related handling logic. Size or length values used in buffer or object management are computed without sufficient validation, allowing the result to wrap around and bypass subsequent bounds checks.

Attack Vector

The attack vector is network-based and requires user interaction. The victim must load a crafted HTML page. Attack complexity is high because the flaw is exploitable only after the renderer process has already been compromised through a separate vulnerability. Successful exploitation crosses a security boundary, impacting confidentiality, integrity, and availability of the host system.

See the Chromium Issue Tracker Entry for upstream details and the Google Chrome Stable Update advisory.

Detection Methods for CVE-2026-13801

Indicators of Compromise

Chrome browser processes spawning unexpected child processes or shells following navigation to untrusted pages.
Anomalous file writes or persistence artifacts originating from the Chrome parent process rather than the renderer.
Crash reports or chrome.exe termination events referencing the Chromecast or media router components.

Detection Strategies

Inventory Chrome installations across managed endpoints and flag versions below 150.0.7871.47.
Correlate browser crash telemetry with subsequent process creation or network beaconing events.
Monitor for outbound connections initiated by Chrome to non-standard destinations shortly after page navigation.

Monitoring Recommendations

Enable browser telemetry and forward Chrome crash and stability logs to a centralized analytics pipeline.
Alert on process lineage where Chrome spawns interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Track version compliance continuously through endpoint management tooling and software inventory scans.

How to Mitigate CVE-2026-13801

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update completes to ensure the patched binaries are loaded.
Verify enterprise auto-update policies are enforcing the stable channel and not blocking upgrades.

Patch Information

Google released the fix in the stable channel update for desktop covering Chrome 150.0.7871.47. Details are available in the Google Chrome Stable Update release notes. The underlying defect is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict user browsing to trusted sites through web filtering while patching is in progress.
Enforce site isolation and strict sandbox policies via Chrome Enterprise configuration.
Disable Chromecast and media casting features through policy where operationally acceptable until patches are applied.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: check version from the application bundle
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString