CVE-2026-13890: Google Chrome Information Disclosure Flaw

CVE-2026-13890 Overview

CVE-2026-13890 is an out-of-bounds read vulnerability [CWE-125] in the Chromecast component of Google Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can read potentially sensitive information from process memory by delivering a crafted HTML page. Google classifies the Chromium security severity as Medium, and the NVD assigns a CVSS 3.1 base score of 5.3. The flaw affects Chrome on Windows, macOS, and Linux desktop platforms. Exploitation requires user interaction and a chained renderer compromise, which raises attack complexity but does not eliminate risk for targeted users.

Critical Impact
A successful attack leaks memory contents from the Chrome renderer process, which can expose secrets, tokens, or pointers useful for further exploitation and sandbox escape chains.

Affected Products

Google Chrome prior to 150.0.7871.47 on Microsoft Windows
Google Chrome prior to 150.0.7871.47 on Apple macOS
Google Chrome prior to 150.0.7871.47 on Linux

Discovery Timeline

2026-06-30 - CVE-2026-13890 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13890

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] within Chrome's Chromecast component. The Chromecast integration handles media routing and casting messages processed within the renderer context. When a crafted HTML page triggers specific code paths in this component, the code reads memory beyond the intended buffer boundary. The read returns data from adjacent memory regions, which the attacker can exfiltrate through observable side effects or by echoing values back to attacker-controlled JavaScript. This class of flaw does not directly grant code execution, but it defeats memory layout randomization and exposes secrets held in the renderer address space.

Root Cause

The defect stems from insufficient bounds checking on data structures parsed by the Chromecast component. The affected code path assumes input dimensions or offsets are validated upstream and reads based on attacker-influenced values without confirming they remain inside the allocated buffer. Chromium engineers addressed the issue in Chrome 150.0.7871.47. See the Chromium Issue Tracker Entry for technical details.

Attack Vector

Exploitation requires the attacker to first compromise the renderer process, typically through a separate memory corruption bug. The attacker then loads a crafted HTML page that exercises the Chromecast code path and triggers the out-of-bounds read. User interaction is required, and attack complexity is high because of the chained renderer prerequisite. The leaked memory can support sandbox escape chains, credential theft, or reliable exploitation of other Chrome vulnerabilities.

No public proof-of-concept code is available for CVE-2026-13890. Refer to the Google Chrome Stable Update for vendor guidance.

Detection Methods for CVE-2026-13890

Indicators of Compromise

Chrome browser processes running versions older than 150.0.7871.47 after the patch release window
Renderer process crashes or unusual memory access patterns coinciding with visits to untrusted sites
Outbound connections from renderer processes to domains hosting Chromecast-related payloads or unexpected media routing traffic

Detection Strategies

Inventory Chrome installations across endpoints and flag versions below 150.0.7871.47 as vulnerable
Correlate browser telemetry with process integrity events to identify chained renderer compromise attempts
Hunt for anomalous child process creation or memory disclosure patterns originating from chrome.exe renderer instances

Monitoring Recommendations

Enable enterprise browser telemetry and forward crash reports to a central analytics platform
Monitor DNS and web proxy logs for connections to newly registered or low-reputation domains delivering casting-related content
Track Chrome update compliance through endpoint management tooling and alert on stalled update rollouts

How to Mitigate CVE-2026-13890

Immediate Actions Required

Update all Chrome installations to version 150.0.7871.47 or later across Windows, macOS, and Linux endpoints
Restart browsers after patching to ensure the vulnerable code is unloaded from running processes
Verify enterprise update policies are enforcing the stable channel and not deferring critical security releases

Patch Information

Google released the fix in Chrome stable channel version 150.0.7871.47. Deploy the patched build via managed update infrastructure or by allowing Chrome's built-in updater to complete. Full details are in the Google Chrome Stable Update advisory.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching completes
Disable Chromecast and media routing features via the EnableMediaRouter enterprise policy where casting is not required
Enforce site isolation and strict sandboxing policies to raise the cost of chaining a renderer compromise with this bug

bash

# Verify Chrome version on Linux endpoints and flag vulnerable installs
google-chrome --version | awk '{print $3}' | \
  awk -F. '$1<150 || ($1==150 && $2==0 && $3<7871) || \
           ($1==150 && $2==0 && $3==7871 && $4<47) {print "VULNERABLE"}'