CVE-2026-13859: Google Chrome RCE Vulnerability

CVE-2026-13859 Overview

CVE-2026-13859 is a sandbox escape vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome prior to version 150.0.7871.47. The flaw stems from inappropriate implementation logic in ANGLE, which translates OpenGL ES calls to native graphics APIs. A remote attacker can exploit this issue by convincing a user to load a crafted HTML page, potentially breaking out of the Chrome renderer sandbox. The weakness is categorized under [CWE-693: Protection Mechanism Failure]. Successful exploitation grants attackers execution capabilities outside the browser's isolation boundary, affecting Chrome installations on Windows, macOS, and Linux.

Critical Impact
A remote attacker can escape the Chrome sandbox via a crafted HTML page, gaining execution capabilities beyond the browser's renderer isolation boundary.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers embedding vulnerable ANGLE builds

Discovery Timeline

2026-06-30 - CVE-2026-13859 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13859

Vulnerability Analysis

ANGLE serves as Chrome's graphics translation layer, converting WebGL and OpenGL ES calls into platform-native graphics APIs such as Direct3D on Windows, Metal on macOS, and Vulkan or OpenGL on Linux. The component runs in the GPU process, which holds elevated privileges relative to the renderer sandbox. An inappropriate implementation in ANGLE allows a crafted HTML page to trigger conditions that undermine sandbox boundaries. The vulnerability requires user interaction, meaning a victim must visit an attacker-controlled or compromised web page. Once triggered, the flaw enables code paths that were not intended to be reachable from untrusted web content.

Root Cause

The root cause lies in ANGLE's protection mechanism failure, mapped to [CWE-693]. Specific code paths handling graphics operations do not enforce the isolation guarantees required for content originating from untrusted origins. The Chromium security team classified the severity as Medium internally, though the CVSS scoring reflects the broader sandbox-escape impact.

Attack Vector

Exploitation begins when a user loads a malicious HTML page containing crafted WebGL or graphics content. The page issues graphics API calls that traverse ANGLE's translation logic and reach the vulnerable code path. Because the GPU process handles requests from multiple renderers, a successful escape can extend attacker influence beyond a single tab. No authentication or prior access is required, and the attack originates entirely over the network.

No verified public exploit code is available for CVE-2026-13859. Technical implementation details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13859

Indicators of Compromise

Chrome browser processes spawning unexpected child processes outside the standard renderer or GPU process tree
GPU process crashes or unusual restarts correlated with browsing sessions to untrusted domains
Outbound network connections from Chrome-related processes to unfamiliar infrastructure following page loads with WebGL content

Detection Strategies

Monitor endpoint telemetry for anomalous process ancestry originating from chrome.exe or the GPU helper process
Correlate browser crash reports referencing ANGLE, D3D, Metal, or GL translation modules with visits to attacker-controlled domains
Inspect web proxy logs for HTML pages delivering unusually complex WebGL shaders or graphics payloads to targeted users

Monitoring Recommendations

Track Chrome version inventory across the fleet to identify hosts running builds earlier than 150.0.7871.47
Alert on Chrome installations that fail to auto-update within the standard patch window
Baseline normal GPU process behavior to surface deviations that may indicate exploitation attempts

How to Mitigate CVE-2026-13859

Immediate Actions Required

Update all Google Chrome installations to version 150.0.7871.47 or later across Windows, macOS, and Linux endpoints
Force restart Chrome after the update installs to ensure the patched binaries are loaded into memory
Audit Chromium-based browsers and embedded WebView components that may bundle vulnerable ANGLE builds

Patch Information

Google released the fix in the stable channel update documented in the Google Chrome Stable Update advisory. Enterprises should verify that centrally managed Chrome policies do not delay auto-update delivery beyond the standard rollout window.

Workarounds

Restrict access to untrusted web content through enterprise web filtering until the patch is deployed
Disable hardware acceleration in Chrome as a temporary measure to reduce exposure of the ANGLE code path
Enforce site isolation policies and block WebGL on high-risk endpoints where operationally feasible

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version

# Temporary policy to disable hardware acceleration (Windows registry)
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HardwareAccelerationModeEnabled /t REG_DWORD /d 0 /f