CVE-2026-13925: Google Chrome RCE Vulnerability

CVE-2026-13925 Overview

CVE-2026-13925 affects Google Chrome on Windows in versions prior to 150.0.7871.47. The flaw is an inappropriate implementation in the Chrome Downloads component. A remote attacker who convinces a user to perform specific user interface gestures can execute arbitrary code through a crafted HTML page. Chromium engineers classified the security severity as Medium, while the NVD scoring places it in the High range based on the impact of arbitrary code execution. The weakness maps to [CWE-20] Improper Input Validation and requires both network delivery and user interaction to succeed.

Critical Impact
A remote attacker can achieve arbitrary code execution on Windows systems running vulnerable Chrome builds if the victim performs specific gestures on an attacker-controlled page.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows hosts running the affected Chrome Stable channel
Downloads component in Chromium-based deployments sharing the affected code path

Discovery Timeline

2026-06-30 - CVE-2026-13925 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-13925

Vulnerability Analysis

The vulnerability resides in the Downloads subsystem of Google Chrome on Windows. Chrome improperly implements the workflow that governs how download prompts and confirmations interact with user gestures. An attacker hosts a crafted HTML page that guides the victim into performing a sequence of clicks or keystrokes. Those gestures are consumed by download flow logic in a way the browser did not intend, allowing execution of arbitrary code on the host.

The attack requires user interaction and high complexity, which limits opportunistic exploitation. However, successful exploitation yields impact to confidentiality, integrity, and availability because arbitrary code runs outside the browser sandbox context expected for downloaded content. The EPSS probability sits at 0.354% with a percentile of 27.4, and no public exploit or CISA KEV listing exists at the time of publication.

Root Cause

The root cause is improper input validation, tracked as [CWE-20], in how the Downloads component interprets user gestures during a download decision. Chrome does not sufficiently constrain the gesture-to-action mapping when a crafted page manipulates UI state. Attackers can chain these gestures to bypass safeguards intended to require explicit user consent before executing a downloaded artifact.

Attack Vector

The attack vector is network-based. An attacker delivers a crafted HTML page through a malicious website, a compromised legitimate site, a malvertising chain, or a phishing link. The page uses layout, timing, and prompts to social-engineer the user into performing the specific gestures that trigger the flaw. Once triggered, the download workflow completes in a way that leads to arbitrary code execution on the Windows host without an additional privilege prompt.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for authoritative technical details.

Detection Methods for CVE-2026-13925

Indicators of Compromise

Chrome processes on Windows spawning unexpected child executables shortly after visiting an untrusted page
New files written to user download directories that immediately execute without a standard SmartScreen or Mark-of-the-Web prompt
Outbound connections from Chrome renderer or utility processes to unfamiliar domains hosting HTML payloads

Detection Strategies

Inventory Chrome installations across Windows endpoints and flag any version below 150.0.7871.47
Hunt for chrome.exe parent processes launching interpreters such as powershell.exe, wscript.exe, cmd.exe, or unsigned binaries from user-writable paths
Correlate browser download events with subsequent process creation to identify gesture-driven execution chains

Monitoring Recommendations

Enable process creation and command-line auditing on Windows endpoints and forward telemetry to a centralized analytics platform
Monitor Chrome update compliance through enterprise management tooling and alert on stalled updates
Track web proxy and DNS logs for access to newly registered domains delivering HTML payloads that trigger download prompts

How to Mitigate CVE-2026-13925

Immediate Actions Required

Update Google Chrome on Windows to version 150.0.7871.47 or later on all managed endpoints
Verify that Chrome auto-update is enabled and unblocked by network egress or group policy restrictions
Restart the browser after the update to ensure the patched binary is loaded into memory

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Update Announcement. Administrators managing Chrome through Group Policy or Chrome Browser Cloud Management should push the updated version and confirm rollout status. Chromium-based browsers that share the affected Downloads code should apply their respective vendor updates once available.

Workarounds

Restrict browsing to trusted sites through web filtering until the patch is deployed
Disable automatic file downloads or require a save-as prompt for every download through enterprise policy
Educate users to avoid performing prompted UI gestures on unfamiliar pages, especially sequences that mimic system dialogs

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Chrome\BLBeacon" /v version
reg query "HKCU\Software\Google\Chrome\BLBeacon" /v version

# Force Chrome update check via Google Update
"%ProgramFiles(x86)%\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler