Google has released Chrome version 150.0.7871.47 for macOS to patch a dangerous vulnerability that allows attackers to break out of the browser’s sandbox after compromising the renderer process. The update, which addresses CVE-2026-13878, is rolling out now and macOS users should apply it immediately.

The Fix: What Google Changed

Chrome 150.0.7871.47 for macOS is a targeted security release. The single CVE it addresses—CVE-2026-13878—is classified as a renderer-compromise-to-sandbox-escape issue. In practical terms, this means an attacker who has already exploited another bug to run code inside Chrome’s renderer (the component that draws web pages) could leverage this flaw to break out of the sandbox and execute arbitrary code on the underlying Mac.

Sandboxing is a critical defense layer. Chrome runs each tab and extension in a separate, restricted environment on macOS. Even if a malicious page triggers a memory corruption bug in the renderer, the attacker should be confined to that sandbox—unable to access files, other processes, or system resources. CVE-2026-13878 punches a hole in that wall. Google’s security advisory, which accompanies every stable channel release, typically withholds technical details until a majority of users have updated. As of this writing, the company has not disclosed whether the vulnerability was exploited in the wild, but the swift patch and the severity classification suggest it’s a high-risk bug.

The version number for the fix is specific: macOS users should see 150.0.7871.47 after updating. No corresponding update has been listed for Windows or Linux in this advisory, indicating the vulnerability is platform-specific to macOS.

What This Means for You

For everyday Mac users

If you use Chrome as your primary browser on a Mac, the risk is real but easily mitigated. Sandbox escapes are among the most severe browser vulnerabilities because they can turn a relatively minor renderer bug into a full system compromise. The attack chain typically works in two stages: first, an attacker tricks you into visiting a malicious or compromised website that exploits a renderer bug (often a memory safety issue); second, they use the sandbox escape to break out and install malware, steal files, or take over your device.

Because this CVE patches the second stage, even if you encounter a renderer exploit, the attacker won’t be able to move beyond the browser. However, that protection only works if you update. Chrome’s automatic update mechanism downloads new versions in the background, but the browser must be relaunched for the patch to take effect. Many users leave Chrome running for weeks, so you may be unprotected even if the update has been downloaded.

To verify you’re safe, open Chrome, go to chrome://settings/help, or click Chrome > About Google Chrome. If the version shown is 150.0.7871.47 or higher, you’re patched. If not, the page will immediately begin downloading the update; once it finishes, click Relaunch.

For IT administrators and enterprise Mac fleets

If you manage Macs in a business or educational environment, this update should be treated as a priority. Chrome for enterprise typically follows the same release cadence as the consumer stable channel, and policies can be set to enforce automatic updates and browser restarts. Using a mobile device management (MDM) tool or your configuration management system, ensure that all enrolled Macs have Chrome updated to at least 150.0.7871.47. Consider also auditing your fleet for any devices that may have fallen behind on updates—older versions are more susceptible to a chain of exploits.

Additionally, if you enforce extended stable releases, check whether the fixed version has been released for that channel. If not, you may need to temporarily switch to the stable channel or apply mitigations such as restricting access to untrusted sites or using additional endpoint security software.

For Windows and Linux users

So far, Google’s advisory does not list this CVE for platforms other than macOS. That means Windows and Linux versions of Chrome are unaffected by this specific sandbox escape. Still, the incident serves as a reminder that platform-specific vulnerabilities do emerge, and keeping all browsers updated is essential. If you use Chrome across multiple devices, always check the About page after a security update is announced.

How We Got Here: A Timeline of Browser Sandboxing

Chrome’s multi-process architecture has long relied on sandboxing to isolate renderer processes. On macOS, the sandbox is implemented using the operating system’s Sandbox framework, which restricts what system calls and resources the process can access. While effective, sandboxing is not impenetrable—escape bugs have appeared periodically across all major browsers.

Historically, sandbox escapes have been combined with renderer exploits to create powerful attack chains. For example, in 2019, a series of zero-days in Chrome coupled a renderer bug with a sandbox escape to target users on Windows and macOS. These chains are highly valuable to both criminal groups and state-sponsored attackers, often fetching millions of dollars on exploit markets. The existence of CVE-2026-13878, while specifics remain under wraps, likely indicates that a researcher reported the bug through Google’s Vulnerability Reward Program or that an internal audit uncovered the flaw.

Google’s typical disclosure timeline means technical details will be released in the coming weeks. In the meantime, the company has assigned a high severity rating based on the potential impact. It’s worth watching for updates to the CVE entry in MITRE’s database and the official Chrome Releases blog, where the company publishes an abridged version of each stable update’s security fixes.

What to Do Now: Updating, Verifying, and Staying Safe

  1. Update immediately: Open Chrome, navigate to chrome://settings/help, or visit chrome://version for a detailed version string. Wait for the update to download and install. Click Relaunch to complete the process.
  2. Verify the version: After relaunching, go back to chrome://version and confirm that the installed version is 150.0.7871.47 or newer. If you see an older version, repeat the process or consider downloading the latest installer from Google’s website.
  3. Enable automatic updates if they’re off: Go to chrome://settings/help and make sure “Automatically update Chrome” is not disabled. Enterprise users should check their group policies.
  4. Scan for signs of compromise: While difficult after a sandbox escape, it’s prudent to run a malware scan on your Mac. Use built-in tools like XProtect and Malware Removal Tool (both run silently in the background), or third-party software if available. Keep an eye on any unexpected behavior such as new login items, unknown processes in Activity Monitor, or unexpected network connections.
  5. Stay tuned for additional guidance: Google may release more details if exploitation is confirmed. Follow the Chrome Releases blog and consider setting up alerts for the CVE. IT admins should brief their security teams and ensure incident response plans include browser compromise scenarios.

Outlook

While this particular CVE targets macOS only, it highlights a perennial truth: browsers are the most attackable surface on any device, and their layers of security must be constantly reinforced. Sandbox escapes will continue to be top-tier targets for researchers and attackers alike. For now, updating to Chrome 150.0.7871.47 closes off this avenue of attack. In the coming weeks, we’ll be watching for any in-the-wild exploitation reports and the eventual technical write-up that will likely follow Google’s disclosure timeline.

For Windows and Linux users, the takeaway is clear: just because a vulnerability isn’t on your platform today doesn’t mean it won’t be tomorrow. Cross-platform software often shares code, and a similar logic flaw could appear in a future update. Regular updates remain your best defense.