CVE-2026-13888 is a use-after-free vulnerability affecting Google Chrome's Extensions component in versions before 150.0.7871.47. Exploitation involves a remote attacker leveraging a specially crafted HTML page to execute arbitrary code inside Chrome's sandbox environment. The vulnerability was publicly disclosed and patched in version 150.0.7871.47. No CVSS score is provided, but the Chromium security team rates the severity as medium.

Successful exploitation could allow remote code execution within the sandboxed environment of Google Chrome, potentially enabling an attacker to run arbitrary code with the privileges of the browser process. However, the impact is limited by sandbox containment. No known exploits in the wild have been reported at the time of disclosure.

Users should update Google Chrome to version 150.0.7871.47 or later, where this vulnerability is fixed. Since this is a client-side application vulnerability, applying the official update is the primary remediation. No additional vendor advisories indicate alternative mitigations or that no action is required.