CVE-2026-13037: Chrome WebView Use-After-Free Vulnerability on Android

Technical summary

CVE-2026-13037 is a use-after-free vulnerability (CWE-416) in the WebView component of Google Chrome on Android. The flaw allows a local attacker to trigger arbitrary code execution within the Chrome sandbox by delivering a crafted HTML page. The vulnerability exists in Chrome versions prior to 149.0.7827.197. While sandboxed execution limits the immediate scope of compromise, the ability to run arbitrary code within that sandbox can facilitate further exploitation, data exfiltration, or privilege escalation attempts. Chromium has classified this as High severity.

Business impact

Organizations and users relying on Chrome for browsing on Android devices face risk of data theft, credential compromise, or malware installation if an attacker can trick them into visiting a malicious webpage. While the sandbox contains the initial execution, successful exploitation could enable access to cached credentials, browsing history, stored authentication tokens, or other sensitive data accessible to the browser process. For enterprises managing Android devices, this represents a vector for targeted attacks against mobile workforce users.

Affected systems

Google Chrome on Android devices running versions prior to 149.0.7827.197 are vulnerable. This includes all Android variants and device manufacturers that use Chrome as the default or installed browser. The vulnerability does not affect Chrome on desktop operating systems (Windows, macOS, Linux), though users should verify their Chrome version across all platforms. Google Android itself is listed as an affected vendor/product, likely because WebView is a core Android component that third-party apps embed.

Exploitability

Exploitation requires local access to an Android device and user interaction—specifically, the victim must open or view a crafted HTML page, either through a link, email attachment, or malicious website. No network-based exploitation from a remote attacker is possible without social engineering. The CVSS vector (AV:L, AC:L, PR:N, UI:R) reflects this: local attack vector, low attack complexity, no privileges required, but user interaction is mandatory. Once the user views the malicious content, the attack executes automatically within the confines of the Chrome sandbox.

Remediation

Update Google Chrome on Android devices to version 149.0.7827.197 or later. This patch resolves the use-after-free flaw. Users should enable automatic updates in the Google Play Store or manually check for updates in Chrome's settings menu. Organizations with managed Android fleets should enforce this update through their mobile device management (MDM) solution and verify compliance across all deployed devices.

Patch guidance

Google Chrome will automatically offer the update to version 149.0.7827.197 or later through the Google Play Store. Manual update can be triggered from within Chrome Settings > About Chrome, which will check for and install available updates. Administrators managing corporate Android devices should configure MDM policies to enforce installation of this patch version or later and set automatic update schedules to prevent delays. Verify successful patching by checking Settings > About Chrome to confirm the installed version meets or exceeds 149.0.7827.197.

Detection guidance

Monitor Android devices for Chrome version compliance using MDM platforms or endpoint detection tools. On unmanaged devices, users can verify their version at Settings > About Chrome. No behavioral indicators of active exploitation are easily detectable from user actions alone; focus detection efforts on ensuring patch deployment rather than hunting for signs of compromise. If a device has been exposed to untrusted webpages before patching, consider monitoring for unusual Chrome process activity, unexpected battery drain, or data exfiltration. Forensic review of browser history may reveal accessed malicious sites, though the sandbox should limit the blast radius.

Why prioritize this

This vulnerability merits prompt but not emergency patching. It requires user interaction and local access, limiting broad-scale attack feasibility. However, the HIGH CVSS score (7.8) and potential for code execution within the browser context justify prioritization ahead of lower-severity flaws. Organizations with high-risk user populations (executives, developers, security staff) should prioritize patching, as these users are more likely to be targeted with social engineering. The fact that it is not yet in the CISA KEV catalog suggests limited active exploitation at the time of publication, but attackers may develop POCs as awareness spreads.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects the combination of high impact (confidentiality, integrity, and availability all marked as high), local attack vector, and the requirement for user interaction. The sandbox context prevents direct system-wide compromise but does not eliminate the risk: attackers can still exfiltrate data accessible to Chrome, install malware within the sandboxed environment, or leverage the code execution as a stepping stone for privilege escalation attacks. The score appropriately penalizes the local and user-interaction requirements while recognizing the severity of arbitrary code execution.

Frequently asked questions