Catálogo de CVE
CVE-2026-13787
Use after free in Chromoting in Google Chrome on…
Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)
- Gravidade
- Critical · CVSS 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.42% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiantrixie-security | chromium | 156.0.8078.73-1~deb13u1 | Fixed | [CVE-2026-13787] |
| Debiantrixie | chromium | 150.0.7871.181-1~deb13u1 | Fixed | [CVE-2026-13787] |
| Debiantrixie | chromium | 150.0.7871.46-1~deb13u1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debiansid | chromium | 150.0.7871.46-1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debiansid | chromium | 156.0.8078.73-1 | Fixed | [CVE-2026-13787] |
| Debianforky | chromium | 150.0.7871.46-1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debianforky | chromium | 156.0.8078.47-1 | Fixed | [CVE-2026-13787] |
| Debianbookworm-security | chromium | 156.0.8078.73-1~deb12u1 | Fixed | [CVE-2026-13787] |
| Debianbookworm | chromium | 150.0.7871.100-1~deb12u1 | Fixed | [CVE-2026-13787] |
| Debianbookworm | chromium | 150.0.7871.46-1~deb12u1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
Showing 10 fix observations. All 12 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| UnknownRelease not reported | chrome | 150.0.7871.47 | UnknownSource applicability is not established | Provider not reported |
| UnknownRelease not reported | chromium | 150.0.7871.46-1~deb12u1 | UnknownSource applicability is not established | Provider not reported |
| Debianbookworm | chromium | 150.0.7871.100-1~deb12u1 | Fixed | [CVE-2026-13787] |
| Debianbookworm | chromium | 150.0.7871.46-1~deb12u1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debianbookworm-security | chromium | 156.0.8078.73-1~deb12u1 | Fixed | [CVE-2026-13787] |
| Debianforky | chromium | 150.0.7871.46-1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debianforky | chromium | 156.0.8078.47-1 | Fixed | [CVE-2026-13787] |
| Debiansid | chromium | 150.0.7871.46-1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debiansid | chromium | 156.0.8078.73-1 | Fixed | [CVE-2026-13787] |
| Debiantrixie | chromium | 150.0.7871.181-1~deb13u1 | Fixed | [CVE-2026-13787] |
| Debiantrixie | chromium | 150.0.7871.46-1~deb13u1 | FixedDistribution-reported fixed boundary | [CVE-2026-13787] |
| Debiantrixie-security | chromium | 156.0.8078.73-1~deb13u1 | Fixed | [CVE-2026-13787] |
Original provider fields
{
"package_releases": [
{
"name": "chromium",
"status": "fixed",
"release": "sid",
"version": "156.0.8078.73-1"
},
{
"name": "chromium",
"status": "fixed",
"release": "forky",
"version": "156.0.8078.47-1"
},
{
"name": "chromium",
"status": "fixed",
"release": "trixie",
"version": "150.0.7871.181-1~deb13u1"
},
{
"name": "chromium",
"status": "fixed",
"release": "trixie-security",
"version": "156.0.8078.73-1~deb13u1"
},
{
"name": "chromium",
"status": "fixed",
"release": "bookworm",
"version": "150.0.7871.100-1~deb12u1"
},
{
"name": "chromium",
"status": "fixed",
"release": "bookworm-security",
"version": "156.0.8078.73-1~deb12u1"
}
],
"fixed_versions": [
{
"bug": null,
"name": "chromium",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "150.0.7871.46-1"
},
{
"bug": null,
"name": "chromium",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "150.0.7871.46-1"
},
{
"bug": null,
"name": "chromium",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "150.0.7871.46-1~deb13u1"
},
{
"bug": null,
"name": "chromium",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "150.0.7871.46-1~deb12u1"
}
],
"distribution_packages": [
{
"name": "chrome",
"fixed_version": "150.0.7871.47",
"applicability_unknown": true
},
{
"name": "chromium",
"fixed_version": "150.0.7871.46-1~deb12u1",
"applicability_unknown": true
},
{
"name": "chrome",
"ranges": [
{
"fixed": "150.0.7871.47",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13787",
"fixed_version": "150.0.7871.47",
"provider_source": "nvd",
"provider_record_id": "NVD-CVE-2026-13787",
"provider_updated_at": "2026-10-25T17:10:00.197"
}
]
}OpenFactory catalog packages
Os dados de vulnerabilidade estão temporariamente indisponíveis.
Referências
- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11184-1.json]
- [https://issues.chromium.org/issues/522919313]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-13787]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-13787]
- [https://security-tracker.debian.org/tracker/CVE-2026-13787]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13787.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2143.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]