# CVE-2026-13787: Google Chrome use after free in Chromoting

Source: https://junglewise.ai/threats/cve-2026-13787-google-chrome-use-after-free-in-chromoting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-13787 · Severity: info · CVSS 10 · Published 2026-06-30

A critical security vulnerability has been identified in Google Chrome's remote desktop feature (Chromoting) on Windows. This flaw could allow a remote attacker to take control of a user's computer by sending specially crafted network traffic. If exploited, an attacker could execute unauthorized commands, access sensitive data, or disrupt business operations. Users should update to the latest version of Chrome immediately to mitigate this risk.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-13787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13787 being exploited in the wild.

**How severe is CVE-2026-13787?** Informational severity, with a CVSS score of 10, published 30 June 2026.

**Which products and versions are affected?** Google Chrome prior to 150.0.7871.47.

**Is there a fix for CVE-2026-13787?** A patch was published on 2026-06-30: Fixed in stable channel update 150.0.7871.47 for Windows Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-13787 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-13787?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Chromoting (Chrome Remote Desktop) component of Google Chrome for Windows. The flaw is triggered by the improper handling of memory objects during the processing of malicious network traffic. A remote, unauthenticated attacker can exploit this condition to achieve arbitrary code execution (RCE) within the context of the browser or the host system. The vulnerability is addressed in Google Chrome version 150.0.7871.47 and later. Google classifies this as a Critical severity issue.

## Affected products

- Google Chrome prior to 150.0.7871.47

## Timeline

- 2026-06-11: disclosed: Reported to Chromium by Google researchers
- 2026-06-30: patched: Fixed in stable channel update 150.0.7871.47 for Windows
- 2026-06-30: advisory

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html)
- [https://issues.chromium.org/issues/522919313](https://issues.chromium.org/issues/522919313)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)