CVE-2026-13776 is a critical type confusion vulnerability in the Dawn component of Google Chrome before version 150.0.7871.47. It allows a remote attacker, who has already compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could lead to complete compromise of the affected system by breaking the browser's sandbox protections. The CVSS 3.1 base score is 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to escape the Chrome sandbox, potentially leading to full system compromise. The attacker must have already compromised the renderer process and then use a crafted HTML page to trigger the type confusion flaw. This could result in arbitrary code execution with elevated privileges outside the sandbox.

Google has released an update fixing this vulnerability in Chrome version 150.0.7871.47. Users and administrators should update to this version or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigations are specified by the vendor.