CVE-2026-13849 is a vulnerability in the Chromoting feature of Google Chrome on Windows platforms before version 150.0.7871.47. It arises from insufficient validation of untrusted input, categorized under CWE-20 (Improper Input Validation). This flaw could enable a local attacker to escape the browser's sandbox environment by using a crafted malicious file, potentially leading to full compromise of the affected system. The vulnerability has been assigned a high severity rating with a CVSS v3.1 base score of 8.6, reflecting high impact on confidentiality, integrity, and availability. Although a vendor advisory URL is provided, it does not explicitly state whether an official fix or patch is available.

Successful exploitation could allow a local attacker to escape the sandbox protections of Google Chrome, potentially gaining elevated privileges and executing arbitrary code on the host system. This could lead to full compromise of the affected Windows machine, impacting confidentiality, integrity, and availability of data and system resources.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with local files and avoid executing untrusted content. Monitor official Google Chrome release notes for updates addressing this vulnerability.