CVE-2026-13819 - Vulnerability Details

Description

Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

Published: 2026-06-30

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An out‑of‑bounds read occurs in the ANGLE graphics subsystem of Google Chrome on macOS. When an attacker compromises the renderer process, a crafted HTML page can trigger a memory read beyond allocated bounds, exposing sensitive data from the renderer’s address space. The flaw is identified as CWE‑125.

Affected Systems

Google Chrome for macOS versions earlier than 150.0.7871.47, which employ the ANGLE subsystem. The patch 150.0.7871.47 and later resolves the issue.

Risk and Exploitability

The CVSS score of 8.1 classifies the vulnerability as high severity. Exploitation requires prior compromise of the renderer process; once achieved, the out‑of‑bounds read can leak memory content. The EPSS score of less than 1% and its absence from the CISA KEV catalog suggest limited current exploitation, but the consequence of successful exploitation remains significant.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Google

Chrome

affected

Version	Status	Constraints
`150.0.7871.47`	affected	< 150.0.7871.47

No data.

Vendor Product Confidence Versions

Google

Chrome

100%

Version	Status	Scheme	Platform
`[150.0.7871.47,150.0.7871.47)`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Chrome to version 150.0.7871.47 or newer.
Maintain the default renderer sandbox settings; avoid disabling sandboxing through policy or command‑line options.
Minimize exposure to untrusted or malicious HTML content by restricting or sanitizing web pages fed to the browser.

Generated by OpenCVE AI on July 17, 2026 at 14:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4672-1	chromium security update
Debian DSA	DSA-6378-1	chromium security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00308.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html
https://issues.chromium.org/issues/512962749

History

Fri, 17 Jul 2026 15:15:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Out‑of‑Bounds Read in Google Chrome on macOS

Wed, 15 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
Title	ANGLE Sub‑Bounds Read Vulnerability in Chrome on macOS

Mon, 13 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title		ANGLE Sub‑Bounds Read Vulnerability in Chrome on macOS

Sun, 12 Jul 2026 11:15:00 +0000

Type	Values Removed	Values Added
Title	Chrome ANGLE Subsystem Out‑of‑Bounds Read on macOS

Sat, 11 Jul 2026 09:30:00 +0000

Type	Values Removed	Values Added
Title		Chrome ANGLE Subsystem Out‑of‑Bounds Read on macOS

Fri, 10 Jul 2026 04:30:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in Chrome ANGLE on macOS Exposes Renderer Memory

Thu, 09 Jul 2026 08:30:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in Chrome ANGLE on macOS Exposes Renderer Memory

Wed, 08 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in ANGLE Leading to Remote Memory Disclosure via Compromised Renderer Process in Chrome for macOS

Tue, 07 Jul 2026 22:15:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in ANGLE Leading to Remote Memory Disclosure via Compromised Renderer Process in Chrome for macOS

Mon, 06 Jul 2026 21:15:00 +0000

Type	Values Removed	Values Added
Title	Out‑of‑Bounds Read in ANGLE Leading to Memory Disclosure via Compromised Renderer Process on macOS

Mon, 06 Jul 2026 08:15:00 +0000

Type	Values Removed	Values Added
Title		Out‑of‑Bounds Read in ANGLE Leading to Memory Disclosure via Compromised Renderer Process on macOS

Sun, 05 Jul 2026 20:00:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ANGLE on macOS Chrome Renderer

Sun, 05 Jul 2026 07:45:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ANGLE on macOS Chrome Renderer

Sat, 04 Jul 2026 20:15:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Memory Read in Chrome's ANGLE Graphics Driver on macOS

Sat, 04 Jul 2026 08:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Memory Read in Chrome's ANGLE Graphics Driver on macOS

Sat, 04 Jul 2026 00:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Memory Read in Chrome ANGLE on macOS

Fri, 03 Jul 2026 06:00:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Memory Read in Chrome ANGLE on macOS

Thu, 02 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Title	Out-of-bounds memory read in Chrome's ANGLE renderer on macOS

Thu, 02 Jul 2026 07:15:00 +0000

Type	Values Removed	Values Added
Title		Out-of-bounds memory read in Chrome's ANGLE renderer on macOS

Thu, 02 Jul 2026 00:45:00 +0000

Type	Values Removed	Values Added
Title	Out-of-Bounds Read in ANGLE on macOS Leading to Remote Memory Disclosure

Wed, 01 Jul 2026 16:45:00 +0000

Type	Values Removed	Values Added
Title		Out-of-Bounds Read in ANGLE on macOS Leading to Remote Memory Disclosure

Wed, 01 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 01 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
Vendors & Products		Google Google chrome

Wed, 01 Jul 2026 11:00:00 +0000

Type	Values Removed	Values Added
Title	Chromium ANGLE Out‑of‑Bounds Read Enabling Remote Memory Disclosure on macOS

Wed, 01 Jul 2026 01:00:00 +0000

Type	Values Removed	Values Added
Title		Chromium ANGLE Out‑of‑Bounds Read Enabling Remote Memory Disclosure on macOS

Tue, 30 Jun 2026 23:15:00 +0000

Type	Values Removed	Values Added
Description		Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
Weaknesses		CWE-125
References		https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html https://issues.chromium.org/issues/512962749

Subscriptions

Google Chrome

MITRE

Status: PUBLISHED

Assigner: Chrome

Published: 2026-06-30T22:37:44.807Z

Updated: 2026-07-01T19:12:31.549Z

Reserved: 2026-06-29T23:03:25.461Z

Link: CVE-2026-13819

Vulnrichment

Updated: 2026-07-01T15:09:47.445Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-17T15:00:10Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object