CVE-2026-13782 is a critical use after free (CVSS 10.0) in the Browser component of Google Chrome before 150.0.7871.47. Chromium rates it Critical. It could let an attacker who already compromised the renderer escape the sandbox via a crafted page. Update Chrome to 150.0.7871.47 or later.
What's affected
The record says Google Chrome prior to 150.0.7871.47 is affected, on Windows, macOS and Linux. The fixed version is 150.0.7871.47 or later. The record points to the June 2026 Chrome stable channel update post for the desktop release notes. That page loads its content with scripts and did not render for our fetch, so open it in a browser to see the exact build numbers per platform.
Other Chromium based browsers take Chromium fixes on their own schedule, so check each vendor.
How to check if you're exposed
Open chrome://version in the address bar and read the version number. Anything below 150.0.7871.47 is in range. To trigger an update, open the three dot menu, choose Help, then About Google Chrome, and relaunch when asked.
For managed fleets, check the version through your device management console or with a script that reads the installed Chrome version on each platform.
For a fleet, ask your endpoint tool for the Chrome version on each device and filter for anything below 150.0.7871.47. Chrome updates itself in the background, but the update applies only when the browser relaunches, so long running sessions are a common reason a machine lags.
What to do now
- Open chrome://version and check the build is 150.0.7871.47 or later.
- Use About Google Chrome to update and relaunch the browser.
- Confirm your fleet policy lets Chrome update, and relaunch long running sessions.
- Check other Chromium based browsers and embedded runtimes such as Electron apps against their vendor advisories.
- Keep an eye on the Chrome releases blog for new stable updates.
- Use a policy that forces a relaunch after a set number of days if your organization manages Chrome.
Why it matters
The browser process is the privileged part of Chrome, outside the sandbox, so a memory bug there is the kind that matters most in a chain. The record lists use after free, where memory is used after it has been freed. The perfect score comes from the vector: network reachable, no privileges, changed scope, high impact everywhere.
Read the wording carefully. The record says the attacker has to have compromised the renderer first. A score of 10.0 does not mean a page alone takes over your machine. The record does not flag the CVE as known exploited, and neither the record nor the release post we could reach says it is.
From a defender view, a bug in the browser process is why Chrome keeps its update cycle short. The sandbox limits the damage from a renderer bug, and bugs like this one are about that limit. Updating promptly keeps the limit in place.
The record lists this weakness class: CWE-416 (Use After Free).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does a score of 10.0 mean it is being attacked?
No. The score measures severity from the vector. The record does not mark this as known exploited and says the attacker needs a compromised renderer first.
Is a CVSS of 10.0 common for a browser bug?
It is rare. The score comes from the vector, which is network, no privileges, changed scope and high impact. It does not tell you whether the bug is used in attacks.
Sources
Last reviewed: 19 October 2026.
