CVE-2026-13975: Google Chrome Information Disclosure Flaw

CVE-2026-13975 Overview

CVE-2026-13975 is an out-of-bounds read vulnerability [CWE-125] in ANGLE (Almost Native Graphics Layer Engine), the graphics abstraction layer used by Google Chrome on macOS. The flaw affects Chrome versions prior to 150.0.7871.47. A remote attacker who has already compromised the renderer process can read memory outside allocated bounds by delivering a crafted HTML page. Successful exploitation leaks potentially sensitive information from process memory. Google's Chromium security team rated the severity as Medium.

Critical Impact
Attackers with an existing renderer compromise can read adjacent process memory via crafted HTML rendered through ANGLE, exposing sensitive data such as cross-origin content or memory addresses useful for chaining further exploits.

Affected Products

Google Chrome on macOS prior to version 150.0.7871.47
Apple macOS platforms running vulnerable Chrome builds
Chromium-based components relying on the ANGLE graphics layer

Discovery Timeline

2026-06-30 - CVE-2026-13975 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-13975

Vulnerability Analysis

The vulnerability resides in ANGLE, the translation layer that converts OpenGL ES API calls into native graphics API calls on the host platform. On macOS, ANGLE translates WebGL and GPU operations for Chrome's rendering pipeline. An out-of-bounds read occurs when ANGLE processes attacker-controlled graphics data and reads beyond the allocated buffer boundary.

The attacker must first compromise the renderer process, typically through a separate memory corruption bug or logic flaw. Once inside the sandboxed renderer, the attacker uses ANGLE as a secondary primitive to disclose memory contents. This information can defeat address space layout randomization (ASLR) or leak cross-origin data held in the same process.

Root Cause

The root cause is missing or insufficient bounds validation on buffer offsets or lengths passed into ANGLE's rendering routines. When ANGLE processes crafted graphics inputs originating from a compromised renderer, it dereferences memory outside the intended buffer range. This behavior aligns with [CWE-125: Out-of-bounds Read].

Attack Vector

Exploitation requires two conditions. First, the attacker must already control the renderer process, meaning this vulnerability functions as part of a multi-stage exploit chain. Second, the attacker delivers a crafted HTML page that triggers specific ANGLE code paths on macOS. User interaction is required to load the malicious page. The attack complexity is high because the attacker needs prior renderer compromise and precise control over the graphics input.

No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-13975

Indicators of Compromise

Chrome renderer processes on macOS exhibiting unexpected crashes or GPU-related exceptions tied to ANGLE modules
Outbound connections from Chrome to unfamiliar domains hosting graphics-heavy HTML content prior to anomalous process behavior
Chrome installations running versions earlier than 150.0.7871.47 on macOS endpoints

Detection Strategies

Inventory installed Chrome versions across macOS endpoints and flag any build below 150.0.7871.47
Monitor Chrome renderer process telemetry for abnormal memory access patterns or repeated ANGLE-related faults
Correlate browser exploitation attempts with prior renderer compromise indicators, since this vulnerability requires a chained primitive

Monitoring Recommendations

Ingest browser and endpoint telemetry into a central data lake to detect anomalous child process activity spawned from Chrome
Track access to sensitive resources by browser processes immediately after visits to untrusted pages containing WebGL or GPU workloads
Alert on Chrome version drift when endpoints fail to update within a defined patch window

How to Mitigate CVE-2026-13975

Immediate Actions Required

Update Google Chrome on all macOS endpoints to version 150.0.7871.47 or later
Enforce automatic Chrome updates through mobile device management (MDM) or enterprise configuration profiles
Verify browser version compliance across the fleet and remediate outliers within 72 hours

Patch Information

Google released the fix in Chrome 150.0.7871.47 for the stable desktop channel. Review the Google Chrome Update Notice for full release notes. Additional technical context is available in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing to trusted sites via enterprise policy until patches are deployed
Disable hardware acceleration in Chrome to reduce reliance on ANGLE code paths as a temporary measure
Apply strict site isolation and sandbox policies to limit the impact of any renderer compromise

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Force update via command line
open -a "Google Chrome" --args --check-for-update-interval=1