CVE-2026-13799
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A use-after-free vulnerability in QUIC in Google Chrome prior to 150.0.7871.47 allows a remote attacker to potentially exploit heap corruption via malicious network traffic.
Risk Assessment
An attacker could remotely execute arbitrary code in the browser context, potentially leading to session takeover or sensitive data leakage.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later. Chromium users should apply the corresponding patch when available.
Other vulnerabilities in Chromium
See all- CVE-2026-79223High
Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crafted file. (Severity: Low)
- CVE-2026-14136Medium
Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to perform UI spoofing via a crafted HTML page.
Original NVD description (English source)
Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)