CVE-2026-13875 Overview
CVE-2026-13875 is an information disclosure vulnerability in the GPU component of Google Chrome on Windows. Versions of Chrome prior to 150.0.7871.47 insufficiently validate untrusted input passed to the GPU process. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to read potentially sensitive information from process memory. Google classifies the Chromium security severity as Medium, and the flaw is tracked under CWE-20: Improper Input Validation.
Critical Impact
An attacker who controls a compromised renderer can exfiltrate memory contents from the Chrome GPU process, potentially exposing cross-origin data, tokens, or fragments of other user activity.
Affected Products
- Google Chrome on Windows prior to 150.0.7871.47
- Microsoft Windows platform builds running vulnerable Chrome versions
- Chromium-based derivatives that share the affected GPU code path
Discovery Timeline
- 2026-06-30 - CVE-2026-13875 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13875
Vulnerability Analysis
The vulnerability resides in the GPU process of Chrome on Windows. The GPU process accepts commands and buffer descriptions from the sandboxed renderer process through Chrome's inter-process communication (IPC) channel. When these inputs are not fully validated, the GPU process may read from or return memory regions outside the intended buffer. An attacker who has already achieved code execution inside the renderer can send malformed GPU commands from a crafted HTML page and receive memory fragments belonging to the GPU process in response.
Exploitation requires two conditions. First, the attacker must have compromised the renderer, typically through a separate memory corruption bug. Second, the victim must load a crafted HTML page that triggers the vulnerable GPU code path. This chained requirement explains the medium severity rating rather than a higher score.
Root Cause
The root cause is improper input validation [CWE-20] on data received by the GPU process from the renderer. The trust boundary between the sandboxed renderer and the more privileged GPU process is enforced by validation logic on the GPU side. Missing or insufficient bounds and type checks allow attacker-controlled parameters to reference memory the renderer should not be able to observe.
Attack Vector
The attack vector is network-based and requires user interaction. A victim visits an attacker-controlled or compromised website that first exploits a renderer vulnerability, then issues crafted GPU commands. The GPU process returns sensitive memory contents to the renderer, which the attacker exfiltrates over the network. The attack does not require elevated privileges but does depend on a pre-existing renderer compromise, raising overall attack complexity.
No verified public exploit code is available for CVE-2026-13875. Technical specifics are tracked in the Chromium Issue Tracker Entry.
Detection Methods for CVE-2026-13875
Indicators of Compromise
- Chrome GPU process (gpu-process command line flag) exhibiting abnormal memory read patterns or unexpected crashes in chrome.exe
- Renderer processes executing after loading pages that trigger repeated GPU command submissions from a single origin
- Outbound network traffic from browser sessions containing structured binary blobs immediately after visits to untrusted sites
- Chrome versions reported by endpoint inventory that are older than 150.0.7871.47
Detection Strategies
- Inventory installed Chrome versions across Windows endpoints and flag any build below 150.0.7871.47
- Monitor for renderer-to-GPU IPC anomalies through Chrome's built-in crash and stability telemetry
- Correlate browser process crashes with recent navigation history to identify suspicious origins
- Hunt for staged renderer exploits by looking for known browser exploit indicators preceding GPU activity
Monitoring Recommendations
- Track Chrome update compliance through endpoint management tooling and generate alerts for unpatched hosts
- Log DNS and web proxy telemetry for high-risk browsing sessions to support post-compromise investigation
- Enable Chrome Enterprise reporting to surface crashes and security events centrally
- Review vendor advisories from the Google Chrome Update Blog on each release cycle
How to Mitigate CVE-2026-13875
Immediate Actions Required
- Update Google Chrome to version 150.0.7871.47 or later on all Windows endpoints
- Force a browser restart after deploying the update to ensure the patched binaries are loaded
- Verify Chromium-based browsers used in the environment have absorbed the upstream fix
- Prioritize systems used for high-value browsing such as administrator and developer workstations
Patch Information
Google released the fix in Chrome Stable channel version 150.0.7871.47 for Windows. Details are published in the Google Chrome Update Blog. Chromium code changes are referenced in the Chromium Issue Tracker Entry. Enterprises using Chrome Enterprise or managed browser policies should push the update through their standard channel.
Workarounds
- Restrict browsing to trusted sites through web filtering until patches are deployed
- Disable hardware acceleration in Chrome to reduce exposure of the GPU process, accepting the performance tradeoff
- Enforce site isolation policies and strict sandboxing to increase the cost of chained exploitation
- Apply browser exploit mitigations such as attack surface reduction rules on Windows endpoints
# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# Enterprise policy example: disable GPU hardware acceleration until patched
# HKLM\Software\Policies\Google\Chrome\HardwareAccelerationModeEnabled = 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
