CVE Intelligence
Analysis AI-assisted

CVE-2026-13032: Google Chrome for Android WebGL Use-After-Free Sandbox Escape

CVE-2026-13032 is a use-after-free flaw (CWE-416) in the WebGL component of Google Chrome on Android before 149.0.7827.197. The CNA, Google, reports that a remote attacker could potentially escape the sandbox through a crafted HTML page, and rates the CVSS 3.1 base score at 9.6. No confirmed exploitation appears in the sources consulted, and the record does not list the CVE in CISA KEV.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13032 is a use-after-free vulnerability (CWE-416) in the WebGL component of Google Chrome on Android. The record states that Chrome versions prior to 149.0.7827.197 are affected. Google, as CNA, describes the impact as a potential sandbox escape by a remote attacker using a crafted HTML page, and the Chromium security severity is rated Critical.

Impact

  • The record describes a potential sandbox escape. It does not describe the resulting privileges or data access.
  • The CVSS 3.1 base score of 9.6 is provided by the CNA with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
  • Under the standard meaning of that vector, the attack is network-based, needs no privileges, requires user interaction (such as visiting a page), changes scope, and has high impact on confidentiality, integrity and availability. This reading is our interpretation of the vector.

Affected products and versions

  • Product: Google Chrome on Android.
  • Affected range: versions before 149.0.7827.197.
  • The record does not list any fixed version in its fixes field. The 149.0.7827.197 boundary comes from the affected range and description.
  • The record does not state whether desktop Chrome is affected. The vendor reference links to a desktop stable channel update, but that does not confirm desktop impact for this CVE.

Exploitation status

The CISA KEV entry is not listed in the record. No confirmed exploitation in the wild appears in the sources consulted. This status may change, so it should be rechecked against current advisories.

Remediation and mitigation

  • Update Google Chrome on Android to version 149.0.7827.197 or later, as stated in the affected range.
  • Follow the Chrome Releases stable channel update and check whether your managed devices receive the Android build.
  • For managed fleets, confirm the installed Chrome version across devices and track patch deployment.
  • Limit exposure to untrusted web content on devices that cannot yet be updated, as a temporary risk reduction.

Detection guidance

  • Inventory Chrome versions on Android devices and flag any build older than 149.0.7827.197.
  • Review mobile device management reports for browsers that are not updated.
  • Monitor for unusual browser crashes or renderer failures on unpatched devices, as a general signal of memory-safety issues. The record does not provide specific indicators of compromise.

Limitations of the available information

  • The record does not include a CVSS score from another provider, an EPSS score, or an SSVC decision.
  • The fixes field is empty, so the fixed build is inferred from the affected range.
  • The Chromium issue tracker entry is listed as requiring permissions, so its details could not be verified here.
  • The record gives no technical details beyond the description, so no further exploitation conditions are known.

Frequently asked questions

Which versions of Chrome are affected by CVE-2026-13032?

The record lists Google Chrome on Android versions before 149.0.7827.197 as affected. It does not confirm whether desktop Chrome is affected.

Is CVE-2026-13032 known to be exploited in the wild?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. Recheck current advisories, since this status can change.

What should administrators do about CVE-2026-13032?

Update Chrome on Android to version 149.0.7827.197 or later, verify the installed version across managed devices, and reduce exposure to untrusted web content on devices that cannot yet be updated.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.