Loading vulnerability…
Out-of-bounds memory access in Chrome Blink InterestGroups
CVE-2026-13033 is an out-of-bounds read and write vulnerability in Google Chrome's Blink InterestGroups component, associated with the Privacy Sandbox Protected Audience advertising auction mechanism. It affects Chrome versions before 149.0.7827.197 and allows a remote attacker to execute arbitrary code through a crafted HTML page. The out-of-bounds read can also expose adjacent memory contents to a malicious page. Some product advisories describe the vulnerability specifically as an out-of-bounds read. Microsoft Edge inherited the vulnerability through Chromium.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can enable arbitrary code execution and disclosure of adjacent browser memory. The execution privilege level and whether exploitation permits browser sandbox escape are not established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround is identified. Apply the browser or distribution security update and verify that the installed browser version includes the fix.
Patch, then assume compromise.
Update Chrome to the latest supported release. The platform-specific security update identifies fixed releases as 149.0.7827.196 or later for Linux and 149.0.7827.196/197 or later for Windows and macOS; the CVE description identifies versions before 149.0.7827.197 as affected. Update Microsoft Edge to 149.0.4022.96 or later. For Debian trixie, upgrade chromium to 149.0.7827.196-1~deb13u1 or a later patched Debian package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.