What is the CVSS score of CVE-2026-13028?

CVE-2026-13028 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13028?

Google Chrome for Android contains a critical flaw (CVE-2026-13028, CVSS 9.6) that allows attackers to break the browser's security isolation when users visit malicious websites, potentially exposing…. A patch is available.

How to fix or mitigate CVE-2026-13028?

Within 24 hours: Inventory all Android devices with Chrome across your environment (corporate-managed, BYOD, kiosk deployments). Within 7 days: Deploy Chrome version 149.0.7827.197 or later through your MDM platform, auto-update mechanism, or direct user communication. Within 30 days: Verify patch deployment across 95%+ of target devices and review security logs for exploitation indicators.

Google Chrome CVE-2026-13028

EUVD-2026-39032 CRITICAL

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-cc6x-3gf8-2x53

Denial Of Service Google Use After Free Memory Corruption

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page needs only a page visit (UI:R, PR:N, AC:L); the sandbox escape crosses a security boundary (S:C) yielding total compromise (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:30 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome for Android before 149.0.7827.197 stems from a use-after-free in the WebGL graphics component, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox. Rated Critical by Chromium and carrying a CVSS 9.6 with scope change, the flaw threatens full compromise of the browser process boundary on affected Android devices. There is no public exploit identified at time of analysis, and CISA SSVC marks exploitation status as none.

Technical ContextAI

WebGL is the browser API that exposes GPU-accelerated 3D rendering to JavaScript, processing complex, attacker-influenced graphics state inside Chrome's renderer process. The root cause is CWE-416 (Use After Free): a WebGL object is freed while a dangling reference remains usable, so subsequent access operates on reclaimed memory whose contents an attacker can groom. Because this code path interacts with GPU/graphics buffers that can cross Chrome's sandbox boundary, corrupting the freed object enables a sandbox escape rather than a renderer-only crash. The CPE cpe:2.3:a:google:chrome identifies the affected software as the Google Chrome application, with this advisory scoped specifically to the Android build.

RemediationAI

Vendor-released patch: upgrade Google Chrome on Android to 149.0.7827.197 or later, which is the fixed Stable channel build per the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html; on Android this is delivered via the Google Play Store, so ensure automatic Play updates are enabled and force-update managed fleets through MDM. Until the update is applied, the most direct compensating control is to disable WebGL by setting chrome://flags or enterprise policy to block WebGL/hardware-accelerated graphics (trade-off: breaks legitimate 3D/canvas-heavy sites and some web apps), and to restrict browsing to trusted sites since exploitation requires loading a crafted HTML page. Standard enterprise hardening via Chrome Browser Cloud Management to enforce the minimum version is the cleanest path.