What is the CVSS score of CVE-2026-13032?

CVE-2026-13032 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13032?

A critical vulnerability in Android Chrome allows remote attackers to compromise devices when users visit malicious websites, threatening access to sensitive corporate data and networks.. A patch is available.

How to fix or mitigate CVE-2026-13032?

24 hours: Inventory all Android devices running Chrome in your organization and assess which have access to corporate networks or sensitive data. 7 days: Deploy Chrome on Android version 149.0.7827.197 or later to all managed devices via device management tools, MDM platforms, or app store policies. 30 days: Verify patch deployment across all devices; audit logs for any suspicious activity during the unpatched period.

Google Chrome CVE-2026-13032

EUVD-2026-39033 CRITICAL

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-37jm-qcw2-gcqg

Denial Of Service Google Use After Free Memory Corruption Red Hat

9.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote crafted page with no auth but required user navigation (UI:R); WebGL UAF crosses the sandbox boundary (S:C) enabling high impact, consistent with vendor Critical rating.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Red Hat

9.6 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:30 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

9.6 (CRITICAL)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

CRITICAL 9.6

DescriptionCVE.org

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Sandbox escape in Google Chrome on Android before 149.0.7827.197 stems from a use-after-free in the WebGL graphics subsystem, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS 9.6 reflecting scope change and total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and the issue is not on CISA KEV, though Google has shipped a fix.

Technical ContextAI

WebGL is Chrome's JavaScript-exposed binding to GPU rendering (OpenGL ES/ANGLE), processed in the GPU process which sits at a higher privilege boundary than the renderer sandbox. The flaw is CWE-416 Use After Free: WebGL object lifetime is mishandled so a freed memory region is later referenced, allowing an attacker to control the contents of reclaimed memory through carefully sequenced WebGL calls from a web page. Because WebGL drives the GPU process, a successful UAF there is the classic primitive used to escape the renderer sandbox, which is exactly the impact noted here. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* and EUVD scoping confirm the affected component is the Chrome browser application, specifically the Android build per the advisory text.

RemediationAI

Update Google Chrome on Android to 149.0.7827.197 or later - Vendor-released patch: 149.0.7827.197, available via the Google Play Store and documented in the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. Chrome auto-updates on Android, but verify the version under Settings and relaunch to apply, since the fix is inert until the browser process restarts. If immediate patching is not possible, reduce exposure by avoiding untrusted web pages and, in managed environments, you can disable WebGL via the enterprise policy/flag (chrome://flags or policy controls) as a compensating control - the trade-off is that WebGL-dependent sites (maps, 3D, games, some canvas-accelerated apps) will break or render incorrectly. There is no separate workaround published by the vendor, so upgrading remains the definitive fix.