CVE-2026-13781 is a critical flaw (CVSS 9.6) in Skia in Google Chrome before 150.0.7871.47. Insufficient validation of untrusted input could let an attacker who already compromised the renderer escape the sandbox via a crafted page. Update Chrome to 150.0.7871.47 or later.
What's affected
The record says Google Chrome prior to 150.0.7871.47 is affected, on Windows, macOS and Linux. The fixed version is 150.0.7871.47 or later. The record points to the June 2026 Chrome stable channel update post for the desktop release notes. That page loads its content with scripts and did not render for our fetch, so open it in a browser to see the exact build numbers per platform.
Other Chromium based browsers take Chromium fixes on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the address bar and read the version number. Anything below 150.0.7871.47 is in range. To trigger an update, open the three dot menu, choose Help, then About Google Chrome, and relaunch when asked.
For managed fleets, check the version through your device management console or with a script that reads the installed Chrome version on each platform.
What to do now
- Open chrome://version and check the build is 150.0.7871.47 or later.
- Use About Google Chrome to update and relaunch the browser.
- Confirm your fleet policy lets Chrome update, and relaunch long running sessions.
- Check other Chromium based browsers and embedded runtimes such as Electron apps against their vendor advisories.
- Keep an eye on the Chrome releases blog for new stable updates.
Why it matters
Skia is the graphics library Chrome uses to draw page content, and it is handed data by pages. Improper input validation there means a value that should have been rejected can pass through. The record lists that class and nothing narrower, so we do not guess at the mechanism.
This is the same release and the same shape of risk as the other sandbox escape fixes in 150.0.7871.47. The record says the attacker needed a compromised renderer first. It does not flag the CVE as known exploited.
The record lists this weakness class: CWE-20 (Improper Input Validation).
Quick check
Is one update enough for all the Chrome fixes in this release?
Yes. Each record says Chrome prior to 150.0.7871.47 is affected, so updating to that version or later covers them. Check the release post for platform specific builds.
Sources
Last reviewed: 19 October 2026.
