Google Chrome CVE-2026-13844

Exploitation requires local access to the Windows host and the ability to place a malicious file that the privileged Chrome Updater component processes, plus user interaction (CVSS UI:R) to trigger the use-after-free; the vulnerable Updater must be a version prior to 150.0.7871.47. Limiting factors: the attack vector is local (AV:L), not remote, so the attacker must already have a foothold or account on the machine; it is Windows-specific; and SSVC marks it Automatable: no, meaning it is not readily scriptable at scale. No prior application privileges are needed (PR:N), but the required file staging and user interaction meaningfully constrain real-world exploitation to targeted local scenarios.

The signals broadly agree this is a real but not urgent priority. CVSS 3.1 base 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local vector with required user interaction but no prior privileges, and full CIA impact - matching SSVC's Technical Impact of 'total'. However SSVC also reports Exploitation: none and Automatable: no, and EPSS is very low at 0.13% (3rd percentile), so widespread or automated exploitation is unlikely. Not in CISA KEV and no POC is known. The main caveat: exploitation requires local access plus placement of a malicious file and user interaction, so the practical bar is meaningfully higher than the 7.8 alone suggests. This is a patch-in-normal-cycle item for most environments, prioritized higher on shared/multi-user Windows hosts where local attackers are a realistic threat.

A local, low-privilege user on a shared Windows workstation plants a specially crafted malicious file and induces the required user interaction, triggering the use-after-free in the privileged Chrome Updater as it processes the file. The corrupted, higher-privileged Updater execution is steered to run attacker-controlled code, elevating from a standard account to OS-level privileges. No public POC is currently known, and the local vector plus required interaction (AV:L/UI:R) keep this a targeted rather than opportunistic technique.