CVE-2026-13967 is a heap buffer overflow vulnerability in the V8 JavaScript engine used by Google Chrome. It affects versions prior to 150.0.7871.47 and enables remote attackers to execute arbitrary code inside the sandbox environment by delivering a specially crafted HTML page. The vulnerability is rated high severity with a CVSS 3.1 score of 8.8, indicating network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Google has released a stable channel update to fix this issue.

Successful exploitation of this vulnerability could allow remote attackers to execute arbitrary code within the sandboxed environment of the browser. This could lead to compromise of confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction (visiting a malicious HTML page). No known exploits in the wild have been reported at this time.

Google has released an update in Chrome version 150.0.7871.47 that addresses this vulnerability. Users and administrators should update to this version or later to remediate the issue. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified.