CVE-2026-13799
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A use-after-free vulnerability in QUIC in Google Chrome prior to 150.0.7871.47 allows a remote attacker to potentially exploit heap corruption via malicious network traffic.
Risk Assessment
An attacker could remotely execute arbitrary code in the browser context, potentially leading to session takeover or sensitive data leakage.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later. Chromium users should apply the corresponding patch when available.
Other vulnerabilities in Chromium
See all- CVE-2026-11099Medium
A vulnerability was found in the Skia component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.
- CVE-2026-11053Medium
A vulnerability was found in the WebRTC component of the Chromium browser. Technical details are not provided beyond a reference to the upstream bug.
- CVE-2026-79223High
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Severity: Low)
- CVE-2026-14136Medium
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to perform UI spoofing via a crafted HTML page.
Original NVD description (English source)
Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)
Vulnerability data from NVD (NIST) · CISA KEV · EPSS