CVE-2026-13283: Chrome Android Use-After-Free in AdFilter (CVSS 7.5)

Technical summary

CVE-2026-13283 is a use-after-free vulnerability (CWE-416) in the AdFilter component of Google Chrome on Android versions prior to 149.0.7827.201. The flaw occurs when the browser accesses memory that has already been freed, typically due to incorrect object lifecycle management. An attacker can craft an HTML page designed to manipulate AdFilter state through user interaction, triggering the dangling pointer dereference. Successful exploitation requires user participation—specifically, the victim must perform particular UI gestures that interact with the affected code path. Once triggered, the use-after-free can be leveraged to achieve arbitrary code execution in the context of the Chrome process.

Business impact

This vulnerability presents a material risk to organizations with users accessing corporate or sensitive content via Chrome on Android devices. Successful exploitation could grant attackers the ability to steal session tokens, intercept sensitive data in transit, install malware, or pivot to other systems on the network. The high CVSS score (7.5) reflects the severity potential. Organizations relying on Chrome as a primary mobile browser should prioritize patching to minimize exposure. The attack surface is limited by the need for user interaction, but social engineering campaigns targeting mobile users remain a credible delivery vector.

Affected systems

Google Chrome on Android versions before 149.0.7827.201 are vulnerable. This includes all Chrome releases for Android from the vulnerable code inception up to and including 149.0.7827.200. Desktop Chrome and Chrome on other platforms are not affected by this specific issue. The vulnerability also indirectly affects users on Google Android devices who use the affected Chrome versions.

Exploitability

Exploitation requires two conditions: (1) a crafted malicious HTML page served to or visited by the victim, and (2) the victim performing specific UI gestures (such as particular touch interactions) that trigger the vulnerable AdFilter code path. This user interaction requirement moderately raises the attack complexity, but does not make the vulnerability difficult to weaponize in practice. Phishing, compromised advertising networks, or legitimate sites serving malicious ads could be vectors for delivery. No evidence currently indicates active exploitation in the wild or availability of public exploit code.

Remediation

Users should update Google Chrome on Android to version 149.0.7827.201 or later. Google has released patches addressing this use-after-free in the AdFilter component. Organizations should enforce Chrome updates through mobile device management (MDM) solutions where available, or communicate the urgency to users. No workarounds bypass the need for patching; users should avoid untrusted websites and be cautious with links from unexpected sources until patched.

Patch guidance

Update Google Chrome on Android to version 149.0.7827.201 or later. On most Android devices, this update is available through the Google Play Store. Users can verify the Chrome version by navigating to Chrome menu > Settings > About Chrome, which will prompt an automatic check for updates if a newer version is available. For enterprise environments, confirm that MDM policies enforce automatic or scheduled Chrome updates. Test patch deployment in a controlled environment if possible to ensure compatibility with internal applications before broad rollout.

Detection guidance

Monitor Chrome version telemetry on Android devices to identify systems still running versions prior to 149.0.7827.201. Security tools and MDM platforms can report on browser versions across the fleet. Network-level detection is limited, as the attack is triggered on-device through crafted HTML; however, organizations can monitor for unusual Chrome process crashes or unexpected process behavior via endpoint detection and response (EDR) tools. No specific network signatures are available for this vulnerability, as it requires local interaction with rendered content.

Why prioritize this

Despite the moderate user interaction requirement, the combination of remote code execution capability, high CVSS score (7.5), and the prevalence of mobile Chrome usage in both consumer and enterprise contexts warrant rapid patching. The AdFilter component is active during normal browsing, meaning a user visiting a compromised or malicious site could inadvertently trigger the vulnerability. Mobile devices often contain sensitive corporate data and credentials, making them high-value targets. Organizations with users accessing email, financial systems, or intellectual property via Chrome on Android should treat this as a priority remediation item.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-exploitable vulnerability with high integrity, confidentiality, and availability impact. The user interaction requirement (UI:R) prevents a score above 8.8, and the scope remains unchanged (S:U). Attack complexity is rated as high (AC:H) due to the need for specific UI gestures and presumably exact timing or state conditions. The attack vector is network (AV:N), meaning the malicious HTML can be delivered remotely. Overall, this score appropriately captures a serious but not critical vulnerability requiring expedited but not emergency response.

Frequently asked questions