CVE-2026-13833: Google Chrome Information Disclosure Flaw

CVE-2026-13833 Overview

CVE-2026-13833 is an uninitialized memory use vulnerability in ANGLE, the graphics translation layer used by Google Chrome on macOS. The flaw affects Chrome versions prior to 150.0.7871.47 and allows a remote attacker to leak cross-origin data through a crafted HTML page. Google's Chromium project rated the security severity as High, while the NVD assigned a Medium CVSS score reflecting the confidentiality-only impact and required user interaction.

The issue is tracked in Chromium as issue 513920082 and was addressed in the stable channel update for desktop published by Google.

Critical Impact
A remote attacker can bypass the same-origin policy and read cross-origin data by luring a victim to a malicious HTML page that triggers uninitialized memory access in ANGLE.

Affected Products

Google Chrome on macOS prior to 150.0.7871.47
Apple macOS (as the affected platform for the ANGLE code path)
Chromium-based browsers on macOS that embed the vulnerable ANGLE version

Discovery Timeline

2026-06-30 - CVE-2026-13833 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13833

Vulnerability Analysis

ANGLE (Almost Native Graphics Layer Engine) translates OpenGL ES API calls used by Chrome's WebGL implementation into native graphics APIs, including Metal on macOS. The vulnerability is classified as [CWE-457] Use of Uninitialized Variable. When ANGLE processes specific graphics operations triggered from JavaScript or WebGL content in a crafted HTML page, it reads from a memory region that has not been initialized before use.

The uninitialized memory can contain residual data from prior allocations belonging to other origins or browser processes. When this data is returned to the rendering pipeline or exposed through readable graphics buffers, an attacker script can reconstruct fragments of that data. This effectively breaks the same-origin policy enforced by the browser.

Exploitation requires the victim to visit an attacker-controlled page, and no additional privileges are needed. Chrome's process sandbox limits direct code execution, but data disclosure across origins remains achievable.

Root Cause

The root cause is a code path in ANGLE that consumes a memory buffer or variable before it is fully populated. The condition is deterministic enough that a crafted sequence of WebGL calls can influence which uninitialized bytes are surfaced back to the caller, producing an information leak primitive.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a malicious HTML page containing WebGL or graphics-related JavaScript that exercises the vulnerable ANGLE code path. When a user on macOS running a vulnerable Chrome build loads the page, the browser leaks cross-origin data to the attacker's script, which can exfiltrate the data over the network.

The vulnerability manifests in ANGLE's macOS graphics translation code. Refer to the Chromium Issue Tracker entry #513920082 for technical details as they become public.

Detection Methods for CVE-2026-13833

Indicators of Compromise

Chrome browser installations on macOS reporting a version string earlier than 150.0.7871.47
Outbound HTTPS or WebSocket traffic from browser processes to newly registered or low-reputation domains immediately after WebGL-heavy page loads
Unexpected renderer process crashes or GPU process errors in Chrome logs after visiting untrusted sites

Detection Strategies

Inventory Chrome versions across macOS endpoints and flag any build prior to 150.0.7871.47
Monitor DNS and web proxy logs for user navigation to domains hosting suspicious WebGL or canvas-heavy content
Correlate browser child process telemetry with outbound network beacons that follow visits to untrusted origins

Monitoring Recommendations

Enable endpoint telemetry for browser process behavior, including child process creation and network egress from renderer processes
Alert on macOS hosts running Chrome versions that fall behind the current stable channel release
Track user reports of browser instability or graphical anomalies as potential indicators of exploitation attempts

How to Mitigate CVE-2026-13833

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 150.0.7871.47 or later
Verify that Chrome auto-update is enabled and functioning by checking chrome://settings/help on managed devices
Restart Chrome after the update to ensure the patched ANGLE component is loaded
Prioritize patching for users who routinely browse untrusted content or handle sensitive data in the browser

Patch Information

Google released the fix in the Chrome stable channel update for desktop. See the Google Chrome Desktop Update advisory for release notes. Administrators managing fleets through MDM should push the update via their standard Chrome deployment channel.

Workarounds

Disable WebGL in Chrome by setting the chrome://flags/#disable-webgl flag or through enterprise policy WebGLEnabled set to false until patching is complete
Restrict access to untrusted websites through enterprise web filtering and DNS security controls
Advise users to avoid clicking untrusted links on macOS devices until the Chrome update is deployed

bash

# Enforce disabling WebGL via Chrome enterprise policy on macOS
defaults write com.google.Chrome WebGLEnabled -bool false

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version