CVE-2026-13877 Overview
CVE-2026-13877 is an information disclosure vulnerability in the ANGLE (Almost Native Graphics Layer Engine) component of Google Chrome versions prior to 150.0.7871.47. The flaw stems from insufficient validation of untrusted input, classified as [CWE-20]. A remote attacker who has already compromised the renderer process can read potentially sensitive data from process memory using a crafted HTML page. Google rated the Chromium security severity as Medium. The vulnerability affects Chrome across Windows, macOS, and Linux platforms.
Critical Impact
Attackers who compromise the renderer process can extract sensitive memory contents through ANGLE, potentially exposing cross-origin data, credentials, or other in-memory secrets rendered by the browser.
Affected Products
- Google Chrome versions prior to 150.0.7871.47
- Chrome on Microsoft Windows
- Chrome on Apple macOS and Linux
Discovery Timeline
- 2026-06-30 - CVE-2026-13877 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-13877
Vulnerability Analysis
The vulnerability resides in ANGLE, the graphics abstraction layer Chrome uses to translate OpenGL ES API calls to the host platform's native graphics APIs (Direct3D on Windows, Metal on macOS, OpenGL/Vulkan on Linux). ANGLE processes WebGL and WebGPU commands originating from web content.
Insufficient validation of untrusted input inside ANGLE allows a compromised renderer to submit graphics commands or parameters that cause ANGLE to read beyond intended memory boundaries. The resulting data can then be returned to attacker-controlled JavaScript through WebGL readback operations or shader outputs.
Exploitation requires an attacker to first compromise the renderer process, typically by chaining this issue with a separate renderer-level bug. Successful exploitation exposes fragments of process memory, which may include cross-origin resources, session tokens, or other sensitive material.
Root Cause
The root cause is improper input validation [CWE-20] within ANGLE's handling of graphics API arguments. Boundary or type checks on values supplied through the WebGL/WebGPU command stream are insufficient, allowing an attacker to trigger reads of uninitialized or out-of-bounds memory regions.
Attack Vector
The attack requires network delivery of a crafted HTML page and user interaction to load it, plus prior compromise of the renderer sandbox. The high complexity and precondition of a compromised renderer limit the vulnerability's practical exploitability. Once these conditions are met, the attacker gains read access to process memory but cannot modify data or degrade availability.
No verified proof-of-concept code is publicly available. See the Chromium Issue Tracker entry for technical context.
Detection Methods for CVE-2026-13877
Indicators of Compromise
- Chrome renderer processes exhibiting abnormal GPU IPC traffic or repeated WebGL context creation from a single origin.
- Browser crash reports referencing ANGLE modules such as libGLESv2.dll, libANGLE.dylib, or shader compiler stack frames.
- Outbound connections from endpoints running Chrome builds older than 150.0.7871.47 to unfamiliar hosts serving heavy WebGL content.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any instance below 150.0.7871.47.
- Correlate browser crash telemetry with process-injection or renderer-exploit indicators to identify chained exploitation attempts.
- Hunt for suspicious child processes spawned by chrome.exe following visits to unclassified or newly registered domains.
Monitoring Recommendations
- Ingest Chrome update channel and version telemetry into your SIEM to track patch coverage.
- Monitor endpoint EDR telemetry for renderer sandbox escapes, which are the prerequisite for exploiting this issue.
- Alert on Chrome processes with unexpected memory read patterns or crashes in graphics libraries.
How to Mitigate CVE-2026-13877
Immediate Actions Required
- Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
- Force-restart Chrome after the update to ensure the patched binary is loaded into memory.
- Verify enterprise-managed Chrome policies do not defer or block auto-updates.
Patch Information
Google released the fix in the Stable channel update announced on the Chrome Releases blog. Administrators should confirm deployment through the Chromium Issue Tracker reference and enterprise update reporting.
Workarounds
- Disable hardware acceleration in Chrome (chrome://settings → System) to reduce ANGLE usage until patches are applied.
- Restrict WebGL through enterprise policy where business use cases permit, using the DefaultWebGLSetting policy.
- Apply site isolation and strict cross-origin policies to limit the value of memory disclosed from a compromised renderer.
# Verify Chrome version on Linux endpoints
google-chrome --version
# Windows: query installed Chrome version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
# macOS: check installed Chrome version
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
