Google Chrome CVE-2026-13827

Exploitation requires local access to a macOS host running Chrome prior to 150.0.7871.47 plus user interaction (CVSS UI:R): the attacker must place a malicious file and have the Chrome Updater component process it to trigger the use-after-free. This is NOT remotely exploitable (AV:L) and cannot be triggered against the browser purely over the network - the attacker needs the ability to write the malicious file locally and cause the updater to run against it. Limiting factors: macOS-only, the specific Updater code path, the required local presence, and the user-interaction/trigger step, all of which constrain realistic exploitation to attackers who already have some access to the endpoint.

The signals are internally consistent and point to a genuine but non-urgent priority. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms this is a LOCAL attack requiring user interaction, not a remote exploit - an attacker already needs code execution or file-placement ability on the Mac before this bug yields privilege escalation. This is corroborated by SSVC (Exploitation: none, Automatable: no, Technical Impact: total): total impact if triggered, but no observed exploitation and not automatable. EPSS is low (0.13%, 3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation or public exploit code. The high CVSS of 7.8 reflects the total confidentiality/integrity/availability impact of a successful escalation, not ease of exploitation. Net: patch in the normal high-priority cycle rather than as an emergency; the local-access and user-interaction prerequisites meaningfully limit real-world exposure.

A local attacker who already has a foothold on a Mac (for example a standard user account or malware running with limited rights) plants a specially crafted malicious file and induces the Chrome Updater to process it, triggering the use-after-free while the updater runs with elevated privileges. Successful memory corruption lets the attacker escalate from limited local access to the updater's higher privilege level. No public exploit is identified at time of analysis, and the required user interaction and local access raise the bar for a practical attack.