CVE-2026-13038: Critical Use-After-Free in Chrome Autofill on Windows

Technical summary

CVE-2026-13038 is a use-after-free vulnerability (CWE-416) in the Autofill component of Google Chrome on Windows. The flaw occurs when the browser attempts to access memory that has already been freed, typically as a result of improper object lifecycle management or reference counting in the Autofill feature. A remote attacker can craft a specially designed HTML page that induces this memory error, leading to code execution within the Chrome process context. The vulnerability carries a CVSS 3.1 score of 8.8 (HIGH severity) with a network-based attack vector, low attack complexity, and no privilege requirement—only user interaction is needed. Chromium classified this as Critical severity internally.

Business impact

This vulnerability represents a direct path to code execution on Windows endpoints running vulnerable Chrome versions, without requiring any user awareness of security implications or system-level privileges. For organizations, the risk extends to data exfiltration, malware installation, lateral movement, and credential theft—all initiated through routine web browsing. Teams managing large Chrome deployments face pressure to patch quickly to prevent opportunistic compromise. The high exploitability (network-accessible, low complexity) means this is likely to become an active attack vector promptly, particularly against high-value targets.

Affected systems

Google Chrome on Microsoft Windows running versions prior to 149.0.7827.197 are affected. This includes enterprise Chrome deployments, consumer installations, and any Windows system using an out-of-date Chrome browser. Chrome on other operating systems (macOS, Linux, Android, iOS) is not affected by this specific vulnerability. Windows users who have not yet received or applied the security update remain at risk.

Exploitability

Exploitability is high. The attack vector is network-based (a crafted HTML page delivered via web), attack complexity is low (no special conditions required), and only user interaction is needed—specifically, visiting a malicious or compromised webpage. No privilege escalation is required. The barrier to exploitation is primarily delivery and social engineering to ensure a target visits the malicious page; the technical exploitation itself is straightforward for threat actors with memory corruption expertise. The absence of a KEV (Known Exploited Vulnerability) entry indicates this has not yet been publicly exploited at scale, but the combination of easy exploitation mechanics and critical functionality (Autofill, frequently invoked) makes it a prime candidate for rapid adoption by threat actors.

Remediation

Users and administrators must update Google Chrome on Windows to version 149.0.7827.197 or later immediately. For enterprise environments, ensure Chrome is configured to auto-update or deploy the patch through your patch management system. Verify that the update has been applied across all systems, particularly those used by high-risk users (finance, HR, executives, developers). Additionally, consider temporarily disabling Autofill in security-sensitive contexts as a temporary mitigation, though patching is the definitive fix.

Patch guidance

Update Chrome to version 149.0.7827.197 or any subsequent release. On Windows, this update is typically delivered via Chrome's built-in auto-update mechanism; users can manually check by clicking Menu > Help > About Google Chrome. Enterprise administrators should verify compatibility with internal tools and deploy via managed update channels (Google Admin Console, Intune, or equivalent). Test the patched version in a pilot group before organization-wide rollout to ensure no regression with internal workflows or extensions. Monitor deployment metrics to ensure coverage reaches 100%.

Detection guidance

Monitor for (1) Chrome processes accessing memory regions that have been freed, detected through endpoint detection and response (EDR) tools capable of tracking memory anomalies; (2) Chrome crashes or unexpected terminations, which may indicate exploitation attempts; (3) outbound connections from Chrome to unusual or suspicious destinations following webpage visits; (4) process injection or code execution stemming from the Chrome process context. Web proxy and mail gateway logs should be reviewed for delivery of known malicious HTML payloads if indicators of compromise emerge. Prioritize detection on systems belonging to high-value targets.

Why prioritize this

This vulnerability merits immediate prioritization due to its combination of network exploitability, critical code execution impact, and low attack complexity. The Autofill feature is frequently used, increasing the likelihood that users will interact with triggering conditions. While not yet on the KEV list, the attack surface is sufficiently broad and the exploitation method sufficiently straightforward that threat actors are likely to weaponize it within days of public disclosure. Delay in patching directly increases organizational risk of compromise.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability requiring only user interaction, with high impact across confidentiality, integrity, and availability. The score accurately captures the severity; the gap between CVSS (8.8) and Chromium's internal Critical classification likely reflects Chromium's consideration of real-world attack prevalence and the ubiquity of the affected feature. For risk prioritization, treat this as Critical within your environment until patched.

Frequently asked questions