CVE-2026-13815
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
A Use-After-Free vulnerability in the Blink component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The issue is rated as high severity.
Risk Assessment
An attacker can exploit this vulnerability to execute malicious code within the sandboxed environment, potentially compromising user data confidentiality or integrity.
Recommendation
Immediately update Google Chrome to version 150.0.7871.47 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Blink
See all- CVE-2016-5141High
Blink, as used in Google Chrome before version 52.0.2743.116, allows remote attackers to spoof the URL in the address bar via vectors involving a provisional URL for an initially empty document.
- CVE-2026-79216High
Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Medium)
- CVE-2026-13959Medium
Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Original NVD description (English source)
Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)