CVE-2026-13775 is a critical use after free (CVSS 9.8) in the GPU component of Google Chrome before 150.0.7871.47. Chrome rates it Critical. It could let an attacker who already compromised the renderer process escape the sandbox through a crafted page. Update Chrome to 150.0.7871.47 or later.
What's affected
The record says Google Chrome prior to 150.0.7871.47 is affected, on Windows, macOS and Linux. The fixed version is 150.0.7871.47 or later. The record points to the June 2026 Chrome stable channel update post for the desktop release notes. That page loads its content with scripts and did not render for our fetch, so open it in a browser to see the exact build numbers per platform.
Other Chromium based browsers take Chromium fixes on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the address bar and read the version number. Anything below 150.0.7871.47 is in range. To trigger an update, open the three dot menu, choose Help, then About Google Chrome, and relaunch when asked.
For managed fleets, check the version through your device management console or with a script that reads the installed Chrome version on each platform.
What to do now
- Open chrome://version and check the build is 150.0.7871.47 or later.
- Use About Google Chrome to update and relaunch the browser.
- Confirm your fleet policy lets Chrome update, and relaunch long running sessions.
- Check other Chromium based browsers and embedded runtimes such as Electron apps against their vendor advisories.
- Keep an eye on the Chrome releases blog for new stable updates.
Why it matters
A use after free means the program keeps using memory after it has been released, so the memory may hold something an attacker controls. The record lists the class as use after free. The GPU process handles graphics for every page, which makes it a frequent place for these bugs.
The wording matters. The record says the attacker had compromised the renderer process first. This is a sandbox escape bug, the second link in a chain, not a way in on its own. Chrome relies on the sandbox to contain a bad page, so a bug that breaks it is rated Critical. The record does not flag this CVE as known exploited.
The record lists this weakness class: CWE-416 (Use After Free).
Quick check
Can a web page exploit this alone?
The record describes it as a sandbox escape for an attacker who has already compromised the renderer. It is one step in a chain, but the fix still matters.
Sources
Last reviewed: 19 October 2026.
