CVE-2026-13870: Critical Chrome WebView Use-After-Free on Android

Technical summary

CVE-2026-13870 is a use-after-free vulnerability (CWE-416) in the WebView rendering engine of Google Chrome on Android. When WebView processes certain HTML constructs, it may reference memory that has already been freed, allowing an attacker to inject and execute arbitrary code within the sandbox isolation boundary. The attack requires user interaction (visiting a malicious page) but no special privileges. Google classified this as Medium severity in Chromium security terms, though the CVSS 3.1 score of 8.8 reflects the high potential for confidentiality, integrity, and availability impact.

Business impact

Organizations relying on Android devices for corporate access face risk if users browse untrusted content via Chrome. While the sandbox provides partial containment, arbitrary code execution could enable credential theft, data exfiltration, or lateral movement into enterprise systems if the device holds sensitive information or network access. Widespread adoption of Chrome on Android means this affects a large user population. The lack of active exploitation (not yet in the CISA KEV catalog) suggests a brief window to patch before threat actors weaponize it.

Affected systems

Google Chrome on Android in versions prior to 150.0.7871.47 is vulnerable. WebView is the default rendering component used by numerous Android applications for in-app browsing, so the blast radius extends beyond Chrome itself to any app embedding WebView. Desktop Chrome and iOS Chrome are not affected by this variant.

Exploitability

The attack requires user interaction (clicking a link or navigating to a malicious site), which is a standard web attack vector. No special network position, authentication, or system configuration is needed. The payload is delivered remotely as HTML content. Exploitation occurs within the WebView sandbox, which may limit lateral impact but does not prevent the initial code execution. The accessibility and lack of technical barriers mean threat actors will likely prioritize this for targeted campaigns within days of active disclosure.

Remediation

Update Chrome on Android to version 150.0.7871.47 or later. Users should enable automatic app updates in the Google Play Store to receive patches without manual intervention. Organizations should verify that Android device policies enforce minimum Chrome versions and push updates promptly. Applications embedding WebView should also be updated by their developers once patches are released.

Patch guidance

Check the Google Play Store for Chrome updates; version 150.0.7871.47 or higher contains the fix. Automatic updates are typically enabled by default. Administrators managing Android devices via MDM (Mobile Device Management) should configure policies to enforce the patched version and prevent downgrade. Test the patch on a sample device before rolling out organization-wide to confirm compatibility with critical business apps.

Detection guidance

Monitor for Chrome and WebView version numbers below 150.0.7871.47 in your Android device inventory. Endpoint detection can flag processes spawning unusual code execution chains from the WebView process. Network indicators are limited since the malicious content is delivered as HTML; focus on behavioral signals such as unexpected outbound connections from the Chrome process or unusual child process creation. Correlate with web access logs to identify devices that visited suspicious domains around the vulnerability window.

Why prioritize this

Although not yet in active exploitation according to CISA KEV, the 8.8 CVSS score, ease of exploitation (user-click only), and large installed base of Chrome on Android make this high priority. Android devices often hold credentials, emails, and corporate data, raising the risk of lateral movement. The Medium Chromium severity classification may underweight the real-world impact given the sandbox circumvention. Patch quickly to close the window before active campaigns emerge.

Risk score, explained

CVSS 8.8 (HIGH) reflects remote attack vector, low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. While the Chromium security team rated it Medium internally, the CVSS vector captures the practical severity: arbitrary code execution in a sandbox is still code execution, and WebView's ubiquity across Android apps amplifies blast radius. The lack of KEV inclusion suggests a brief window before widespread exploitation.

Frequently asked questions