What is the CVSS score of CVE-2026-13038?

CVE-2026-13038 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google are affected by CVE-2026-13038?

Google Chrome on Windows is vulnerable to remote code execution through a use-after-free condition in the Autofill component (CVSS 8.8, CVE-2026-13038).. A patch is available.

How to fix or mitigate CVE-2026-13038?

Within 24 hours: Identify and inventory all Windows endpoints running Chrome versions prior to 149.0.7827.197; notify users of the remediation requirement. Within 7 days: Deploy Chrome version 149.0.7827.197 or later across all affected Windows systems. Within 30 days: Verify 100% deployment completion and confirm all vulnerable instances have been updated.

Google CVE-2026-13038

EUVD-2026-39035 HIGH

Use After Free (CWE-416)

2026-06-24 Chrome

GHSA-wc22-hpjh-8x75

RCE Denial Of Service Google Use After Free Memory Corruption Microsoft Red Hat

8.8

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat

8.8 CRITICAL

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 21:31 vuln.today

CVSS changed

Jun 24, 2026 - 20:22 NVD

8.8 (HIGH)

CVE Published

Jun 24, 2026 - 18:43 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 24, 2026 - 18:43 cve.org

HIGH 8.8

DescriptionCVE.org

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

AnalysisAI

Remote code execution in Google Chrome on Windows prior to 149.0.7827.197 stems from a use-after-free condition in the Autofill component, letting a remote attacker run arbitrary code in the renderer when a victim opens a malicious web page. Chromium rates the flaw Critical and CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, tempered by the requirement that the user load attacker-controlled content. There is no public exploit identified at time of analysis, and SSVC records exploitation status as none, but the 'total' technical impact makes prompt patching important.