CVE Intelligence
Analysis AI-assisted

CVE-2026-13028: Google Chrome WebGL Use-After-Free on Android

CVE-2026-13028 is a use-after-free flaw in the WebGL component of Google Chrome on Android, classified as CWE-416. The record describes a remote attacker potentially achieving a sandbox escape through a crafted HTML page, with a CVSS 3.1 base score of 9.6. Chrome on Android should be updated to 149.0.7827.197 or later, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13028 is a use-after-free memory safety flaw in the WebGL component of Google Chrome on Android, mapped to CWE-416. According to the record, a remote attacker could potentially use a crafted HTML page to escape the browser sandbox. The Chromium security severity is rated Critical.

Impact

  • The record describes a potential sandbox escape, which would extend the impact beyond the browser renderer.
  • The CVSS 3.1 base score of 9.6 uses the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network attack, low complexity, no privileges required, user interaction required, scope change, and high confidentiality, integrity and availability impact.
  • Real-world impact depends on how the browser is deployed and on the user interaction needed to load the page.

Affected products and versions

  • Google Chrome on Android prior to 149.0.7827.197, as stated in the record description and version range.
  • The affected list in the record names Google Chrome with the range below 149.0.7827.197. The Android restriction comes from the description.
  • The record contains no separate fixed-version entry. Treating 149.0.7827.197 as the first version outside the affected range is an inference.

Exploitation status

  • CISA KEV does not list this CVE in the record.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Update Google Chrome on Android to version 149.0.7827.197 or later.
  • Review the vendor stable channel release notes linked in the references to confirm the update details.
  • Prioritize managed Android fleets and confirm installed Chrome versions through device management tooling.
  • Limit browsing of untrusted web content on devices that have not yet been updated, as a temporary risk reduction.

Detection guidance

  • Inventory Chrome versions on Android devices and flag any build below 149.0.7827.197.
  • Monitor for unexpected browser crashes or renderer instability on unpatched devices as a general signal, recognizing that such events are not specific to this CVE.

Limitations of the available information

  • The record gives no technical details beyond the description, and the Chromium issue link is listed with a permissions requirement.
  • No EPSS or SSVC data is available.
  • No fix entries are listed in the record, so the fixed version is inferred from the affected range.

Frequently asked questions

What is CVE-2026-13028?

It is a use-after-free flaw in the WebGL component of Google Chrome on Android, classified as CWE-416. The record describes a potential sandbox escape through a crafted HTML page.

Which versions are affected?

According to the record, Google Chrome on Android versions prior to 149.0.7827.197 are affected.

Is this CVE known to be exploited?

CISA KEV does not list it in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.