CVE-2026-13911: Google Chrome Information Disclosure Flaw

CVE-2026-13911 Overview

CVE-2026-13911 is an information disclosure vulnerability in the Spellcheck component of Google Chrome prior to version 150.0.7871.47. The flaw stems from insufficient policy enforcement, allowing a remote attacker who has already compromised the renderer process to read potentially sensitive information from process memory. Exploitation requires the attacker to deliver a crafted HTML page and rely on prior renderer compromise, which raises the attack complexity. Google classifies the Chromium security severity as Medium. The weakness is categorized under [CWE-20: Improper Input Validation].

Critical Impact
A remote attacker with a compromised renderer process can extract sensitive data from Chrome process memory through a crafted HTML page targeting the Spellcheck component.

Affected Products

Google Chrome versions prior to 150.0.7871.47
Chromium-based browsers sharing the affected Spellcheck code path
Desktop Chrome Stable channel builds released before the fix

Discovery Timeline

2026-06-30 - CVE-2026-13911 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13911

Vulnerability Analysis

The vulnerability resides in Chrome's Spellcheck subsystem, which handles text analysis requests originating from renderer processes. Insufficient policy enforcement between the renderer and the Spellcheck service allows a compromised renderer to request or receive data that should remain outside its trust boundary. When paired with a crafted HTML page, an attacker can direct the Spellcheck flow to disclose bytes from process memory. The issue does not by itself grant code execution, but it provides a memory disclosure primitive useful in a broader exploit chain. Chrome sandboxes renderer processes, so this bug is most valuable as a post-compromise step alongside a renderer exploit. The impact is confidentiality-only, with no integrity or availability effects reported.

Root Cause

The root cause is improper enforcement of security policy boundaries within the Spellcheck component. Chromium's process model relies on the browser process to validate and mediate requests from lower-trust renderers. In this case, the Spellcheck path did not sufficiently restrict what a renderer could induce it to process or return, enabling leakage of adjacent memory contents.

Attack Vector

Exploitation requires a two-stage scenario. The attacker first compromises the renderer process, typically through a separate memory corruption bug triggered by malicious web content. The attacker then uses a crafted HTML page to interact with the Spellcheck component in a way that returns sensitive bytes from process memory. User interaction is required to load the malicious page, and the high attack complexity reflects the prerequisite renderer compromise. See the Chromium Issue Tracker Entry for additional technical context.

No verified public proof-of-concept code is available for this issue. Refer to the Google Chrome Stable Update for vendor detail.

Detection Methods for CVE-2026-13911

Indicators of Compromise

Chrome browser processes running versions earlier than 150.0.7871.47 on managed endpoints.
Renderer process crashes or anomalous restarts preceding suspicious outbound HTTP requests.
Unexpected child processes or memory access patterns from chrome.exe handling Spellcheck IPC.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 150.0.7871.47.
Correlate browser exploitation telemetry, such as renderer crashes, with subsequent network activity to attacker-controlled domains.
Monitor for delivery of HTML content that heavily interacts with spellcheck APIs following a suspected renderer compromise.

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and generate alerts for out-of-date instances.
Enable and centralize browser process telemetry, including crash reports and IPC anomalies, in the SIEM.
Review DNS and proxy logs for connections to newly observed domains immediately after browser instability events.

How to Mitigate CVE-2026-13911

Immediate Actions Required

Update all Google Chrome installations to version 150.0.7871.47 or later on Windows, macOS, and Linux.
Force-restart Chrome after deployment to ensure the patched binary is loaded into memory.
Audit Chromium-based browsers and embedded frameworks for equivalent fixes from their upstream vendors.

Patch Information

Google released the fix in the Chrome Stable channel update covered in the Google Chrome Stable Update announcement. Upgrading to 150.0.7871.47 or later remediates the Spellcheck policy enforcement gap. Chromium tracking details are available in the Chromium Issue Tracker Entry.

Workarounds

Disable Chrome's Spellcheck feature via enterprise policy SpellcheckEnabled=false where operationally acceptable until patching completes.
Enforce strict site isolation and restrict browsing to trusted domains through web filtering while updates are staged.
Apply group policy to enable automatic Chrome updates so future renderer-adjacent bugs are remediated without user action.

bash

# Configuration example: disable Spellcheck via Chrome enterprise policy (Linux)
sudo mkdir -p /etc/opt/chrome/policies/managed
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/spellcheck.json
{
  "SpellcheckEnabled": false
}
EOF