CVE-2026-13788: Critical Use-After-Free in Google Chrome Android – Exploit & Patch Guide

Technical summary

CVE-2026-13788 is a use-after-free vulnerability (CWE-416) in the Fullscreen implementation of Chromium-based Chrome on Android. The vulnerability permits unauthenticated remote code execution through a crafted HTML page. An attacker can trigger the freed memory access during fullscreen operations, bypassing memory protections and achieving arbitrary code execution in the Chrome renderer process. The attack requires user interaction (visiting a malicious page) but no special privileges. This defect carries Chromium's Critical security severity designation, reflecting its memory safety implications and ease of exploitation.

Business impact

Successful exploitation grants attackers code execution within the Chrome browser context on Android devices, potentially enabling credential theft, installation of malware, lateral movement to backend systems via compromised device credentials, or data exfiltration. The reliance on user interaction—visiting a crafted page—makes this suitable for phishing or watering-hole campaigns targeting mobile workers. Organizations with significant Android-based workforces face data loss and device compromise risks. The HIGH CVSS score reflects the severity and likelihood of real-world abuse.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are vulnerable. The vulnerability is specific to Android and does not affect Chrome on Windows, macOS, Linux, or iOS. Organizations should inventory Android devices with Chrome and prioritize patching, particularly in bring-your-own-device (BYOD) environments where update discipline may vary.

Exploitability

The attack has a low barrier to entry: no authentication or special privileges are required, and the network is the sole attack vector. The user interaction requirement (visiting a page) is readily satisfied through phishing, malicious advertisements, or compromised legitimate websites. As of the published date, this vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog, but the straightforward nature of use-after-free exploitation and the critical severity suggest public exploit development is probable. Organizations should assume active exploitation may occur or is imminent.

Remediation

Update Google Chrome on Android devices to version 150.0.7871.47 or later. For managed environments, deploy updates through mobile device management (MDM) policies or auto-update mechanisms. Users should enable automatic updates in Chrome settings (Settings > About Chrome > Enable automatic updates). In organizations where immediate patching is not feasible, consider restricting Chrome usage or increasing monitoring for suspicious browser behavior until patches are applied.

Patch guidance

Verify that Chrome on affected Android devices is updated to 150.0.7871.47 or a later version. Check Settings > About Chrome to view the current version and force an update check. For enterprise deployments, confirm MDM policies are configured to enforce minimum version requirements and auto-update settings. Test patching in a limited pilot before broad rollout to ensure compatibility with organizational web applications and extensions.

Detection guidance

Monitor for exploitation indicators including unexpected Chrome renderer process crashes, privilege escalation attempts from the Chrome sandbox, unusual memory access patterns, and post-exploitation artifacts such as new user accounts or installed applications. Endpoint detection and response (EDR) solutions with mobile support should flag suspicious Chrome process behavior. Review application firewall logs for requests to known malicious domains used in phishing campaigns. Correlate suspicious Android device activity with Chrome crash reports.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of: (1) Critical Chromium severity and HIGH CVSS score, (2) low attack complexity and lack of required privileges, (3) widespread Chrome adoption on Android, (4) ease of exploitation via social engineering, and (5) memory safety defects' historical tendency toward rapid weaponization. Even without current KEV listing, the technical maturity and attractiveness of use-after-free exploitation make this a top-tier mobile security risk.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a remotely exploitable vulnerability requiring only user interaction, with no sandbox bypass necessary for execution within the browser context. The score appropriately captures the confidentiality, integrity, and availability impacts of arbitrary code execution. Chromium's Critical designation aligns with and reinforces this rating. Organizations should treat this as equivalent to or exceeding a critical patching requirement despite the HIGH—not CRITICAL—CVSS label, given the practical exploitability and mobile attack surface.

Frequently asked questions