CVE-2026-13802
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk23th percentile — higher than 23% of all known CVEs
Summary
A use-after-free vulnerability in the Views component of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page by convincing a user to perform specific UI gestures.
Risk Assessment
The risk for the organization includes potential system compromise through arbitrary code execution, leading to data theft, malware installation, or lateral movement within the network.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, and advise users to avoid clicking suspicious links or performing unusual UI gestures.
Original NVD description (English source)
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)