CVE-2026-13794Disclosure(google / chrome)

Vulnerabilidad CVSS 7.5 en Google Chrome. Una app web maliciosa podía ejecutar código en la computadora después de que el usuario la instalara y aceptara una confirmación. CVE-2026-13794 https://issues.chromium.org/issues/513893425. 🚀 #Ciberseguridad #BugBounty #GoogleChrome #Hacking https://t.co/WHeHIMiNzk

Google paid me $2,500 for a Chrome vulnerability I found with the help of GPT-5.5 in 32 minutes. It ended up becoming my first Chrome CVE. The idea came from reading joernchen's research on a Claude Code vulnerability where a crafted link could cause arguments to be interpreted in an unsafe way and eventually lead to code execution. https://0day.click/recipe/2026-05-12-cc-rce/ While reading it, I started wondering whether a similar issue could exist in Chrome PWAs. I gave that idea to GPT-5.5 and asked it to look into the way Chrome handled web app installation and arguments on Windows. 32 minutes later, it had found something worth reporting. The issue affected Chrome web app installation on Windows and, with certain user interaction, could allow a malicious page to trigger code execution. Google classified it as High severity. It became CVE-2026-13794 and Google awarded a $2,500 bounty through @GoogleVRP. NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13794 What I found most interesting was the process. I didn't start by looking for this specific bug. I read someone else's research, thought the same kind of mistake might exist somewhere else, and used GPT-5.5 to test the idea. That was enough to go from a hypothesis to a valid Chrome vulnerability in 32 minutes. Thanks to joernchen for the original research, to Google for the bounty and handling the report, and to @thsottiaux for that May 16 reset!!! First CVE. Hopefully more to come.