CVE-2026-13835: Google Chrome XXE Vulnerability

CVE-2026-13835 Overview

CVE-2026-13835 is a heap corruption vulnerability in the XML component of Google Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation in Chrome's XML handling, which a remote attacker can trigger through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious page, and can lead to arbitrary code execution within the renderer process. Google's Chromium security team rated the underlying issue as High severity. The vulnerability is tracked under [CWE-122] (Heap-based Buffer Overflow).

Critical Impact
A remote attacker who lures a user to a crafted web page can corrupt heap memory in the Chrome renderer, potentially leading to arbitrary code execution and sandbox-adjacent compromise.

Affected Products

Google Chrome for Desktop versions prior to 150.0.7871.47
Chromium-based browsers embedding the vulnerable XML component
Downstream distributions that had not yet incorporated the Chromium fix

Discovery Timeline

2026-06-30 - CVE-2026-13835 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13835

Vulnerability Analysis

The vulnerability resides in Chrome's XML processing implementation. Chrome parses XML content encountered via HTML documents, including inline XML islands, XSLT transformations, and MathML or SVG fragments. An inappropriate implementation in this parsing path allows an attacker-controlled document to drive the renderer into a state where heap memory is corrupted.

Because the entry point is a crafted HTML page, exploitation is drive-by in nature. The victim only needs to load attacker-controlled content in the browser. The scope remains unchanged, meaning the impact is confined to the renderer process context, but heap corruption in the renderer is a well-established primitive for chained sandbox and privilege-escalation attacks.

Root Cause

The root cause is classified as [CWE-122], a heap-based buffer overflow. An inappropriate implementation choice in the XML component leads to memory being written or read outside the bounds of an allocated heap region. Typical triggers for this class of Chrome bug include mismatched size calculations between the parser and downstream consumers, incorrect assumptions about tree structure after mutation, and object lifetime confusion during XSLT or DOM operations.

Attack Vector

The attack vector is remote and network-based over HTTP or HTTPS. An attacker hosts a crafted HTML page that embeds or references XML content shaped to trigger the parsing defect. When a user with a vulnerable Chrome build visits the page, the malicious document forces the XML component to corrupt heap memory. From there, the attacker can attempt to derive arbitrary read and write primitives inside the renderer and pivot to code execution.

No public proof-of-concept has been observed. Technical details are tracked in the Chromium Issue Tracker entry.

Detection Methods for CVE-2026-13835

Indicators of Compromise

Chrome renderer processes crashing with heap corruption signatures shortly after loading external web content
Outbound connections from chrome.exe child renderer processes to previously unseen domains hosting XML or XSLT payloads
Unexpected child processes spawned by Chrome following navigation to untrusted pages

Detection Strategies

Inventory installed Chrome versions across the estate and flag any build earlier than 150.0.7871.47
Correlate browser process crashes with proxy or DNS logs to identify the URL loaded immediately before the crash
Hunt for anomalous file writes or persistence attempts originating from Chrome renderer or utility processes

Monitoring Recommendations

Ingest browser telemetry, EDR process events, and web proxy logs into a central analytics platform for cross-source correlation
Alert on Chrome renderer crashes that repeat across multiple hosts, which can indicate exploitation attempts against a common lure
Monitor for exploit-kit indicators associated with crafted HTML pages delivering XML or XSLT content

How to Mitigate CVE-2026-13835

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints
Force-restart the browser after deploying the update so the patched binary is loaded into memory
Verify patch deployment through enterprise policy reporting or endpoint management inventory
Audit Chromium-based browsers and embedded WebViews for the equivalent fix version

Patch Information

Google addressed the issue in the Stable Channel update announced in the Google Chrome Stable Update advisory. The fix is included in Chrome 150.0.7871.47 for desktop platforms. Administrators should confirm the update has rolled out through Chrome's automatic update mechanism or push it through group policy, Jamf, Intune, or equivalent management tooling.

Workarounds

Restrict browsing to trusted sites through web filtering while patch deployment is in progress
Enforce Chrome's Site Isolation and Enhanced Safe Browsing policies to raise the cost of renderer compromise
Apply enterprise policies that block untrusted XSLT or legacy XML content categories at the proxy tier
Reduce exposure by disabling browser access on high-value systems that do not require web browsing

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows registry check for enterprise-managed Chrome version
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force update on macOS using Google Software Update
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode oneshot