CVE-2026-13845 Overview
CVE-2026-13845 is a use-after-free vulnerability [CWE-416] in the Document Object Model (DOM) implementation of Google Chrome prior to version 150.0.7871.47. A remote attacker can execute arbitrary code inside the Chrome sandbox by tricking a user into visiting a crafted HTML page. The flaw affects Chrome across Windows, macOS, and Linux desktop builds. Google has rated the Chromium security severity as High and issued a fix through the Stable channel update.
Critical Impact
Successful exploitation allows arbitrary code execution within the renderer sandbox, providing a foothold for further sandbox-escape chains and full compromise of the browsing session.
Affected Products
- Google Chrome prior to 150.0.7871.47
- Chromium-based browsers on Microsoft Windows
- Chromium-based browsers on Apple macOS and Linux
Discovery Timeline
- 2026-06-30 - CVE-2026-13845 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-13845
Vulnerability Analysis
The vulnerability is a use-after-free condition in Chrome's DOM subsystem. A use-after-free occurs when a program continues to reference memory after it has been freed, allowing an attacker to control the contents of that memory region. In the browser context, the renderer process handles untrusted HTML, CSS, and JavaScript, which makes DOM lifetime bugs highly reachable from a web page.
An attacker hosts a crafted HTML page that manipulates DOM node references to trigger premature object destruction. The freed memory is then reclaimed with attacker-controlled data through JavaScript allocations. When Chrome later dereferences the stale pointer, the attacker gains control of program flow inside the renderer sandbox.
The attack requires user interaction, typically a single visit to a malicious or compromised site. No authentication is required. The impact extends to confidentiality, integrity, and availability of the browser session.
Root Cause
The root cause is improper lifetime management of a DOM object [CWE-416]. A reference to the object persists after the object has been freed, enabling reuse of the dangling pointer. Details of the specific DOM interface involved are tracked in the Chromium Issue Tracker Entry.
Attack Vector
Exploitation is network-based and delivered through a crafted HTML page. The attacker lures a user to visit the page through phishing, malvertising, or a compromised website. JavaScript in the page manipulates DOM state to trigger the use-after-free and stage a controlled heap layout. The resulting code execution runs inside the renderer sandbox and is typically chained with a sandbox-escape vulnerability for full system compromise.
No public proof-of-concept or exploit is currently listed in ExploitDB, and the flaw is not on the CISA Known Exploited Vulnerabilities catalog. See the Chrome Release Update for vendor details.
Detection Methods for CVE-2026-13845
Indicators of Compromise
- Chrome renderer process crashes with heap corruption signatures shortly after visiting untrusted pages.
- Unexpected child processes spawned by chrome.exe or the renderer helper on macOS and Linux.
- Outbound connections from browser processes to newly registered or low-reputation domains hosting HTML payloads.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any build earlier than 150.0.7871.47.
- Correlate browser crash telemetry with proxy logs to identify users who reached suspicious URLs immediately before the crash.
- Hunt for anomalous process trees where the Chrome renderer spawns shells, scripting engines, or LOLBins.
Monitoring Recommendations
- Enable endpoint telemetry that captures browser process lineage, module loads, and memory protection violations.
- Forward web proxy and DNS logs to a central data lake for retroactive hunting on newly disclosed exploit indicators.
- Alert on Chrome update failures or version drift on managed endpoints.
How to Mitigate CVE-2026-13845
Immediate Actions Required
- Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
- Restart the browser after the update to ensure the patched binaries are loaded.
- Apply the corresponding update to any Chromium-based browsers used in the environment once vendors publish patched builds.
Patch Information
Google released the fix in the Stable channel update announced on the Chrome Releases blog. Users on the Stable channel should receive the update automatically once Chrome is relaunched. Enterprises using managed deployments should push 150.0.7871.47 or later through their software distribution tooling.
Workarounds
- Restrict browsing on unpatched endpoints to a trusted allowlist until updates are deployed.
- Enable Site Isolation and enforce Enhanced Safe Browsing through Chrome enterprise policies to raise exploitation cost.
- Use browser isolation or remote browser technology for high-risk user groups where immediate patching is not feasible.
# Verify installed Chrome version on Linux and macOS
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
