What is the CVSS score of CVE-2026-13283?

CVE-2026-13283 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Google Chrome are affected by CVE-2026-13283?

Google Chrome for Android versions prior to 149.0.7827.201 contain a use-after-free vulnerability in the AdFilter component enabling remote code execution when users visit malicious websites, with no…. A patch is available.

How to fix or mitigate CVE-2026-13283?

Within 24 hours, identify and inventory all Android devices running Chrome and determine current version distribution to assess exposure scope. Within 7 days, prioritize deployment of Chrome 149.0.7827.201 or later to all affected Android devices through mobile device management (MDM) systems or direct user notifications; consider blocking access to sensitive resources from outdated Chrome versions if deployment cannot be immediately completed. Within 30 days, verify that at least 95% of managed Android devices are running the patched version, conduct security awareness training on malicious websites and social engineering vectors, and monitor endpoint logs for exploitation indicators.

Google Chrome CVE-2026-13283

EUVD-2026-39563 HIGH

Use After Free (CWE-416)

2026-06-25 Chrome

GHSA-479w-wqjm-fhvf

RCE Denial Of Service Google Use After Free Memory Corruption

7.5

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Remote crafted page (AV:N) with no auth (PR:N) but requires user gestures (UI:R) and a hard-to-win heap race (AC:H); renderer code execution yields full C/I/A.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

9.6 HIGH

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:13 vuln.today

CVE Published

Jun 25, 2026 - 21:51 cve.org

UNKNOWN (no severity yet)

CVE Published

Jun 25, 2026 - 21:51 cve.org

HIGH 7.5

DescriptionCVE.org

Use after free in AdFilter in Google Chrome on Android prior to 149.0.7827.201 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Use-after-free code execution in Google Chrome's AdFilter component affects the Android build prior to 149.0.7827.201, letting a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page run arbitrary code in the browser process. Google (Chromium) rated it High severity; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.22% (13th percentile), consistent with a memory-corruption bug that requires user interaction and high attack complexity rather than trivial mass exploitation.

Technical ContextAI

The flaw is a CWE-416 Use-After-Free in AdFilter, the ad-filtering/subresource-filtering subsystem inside Chromium's rendering and navigation stack. A use-after-free occurs when a heap object is freed while a dangling pointer to it remains reachable; subsequent reuse of that pointer lets an attacker groom the heap and redirect control flow, which in a browser typically yields renderer-process code execution that can then be chained toward a sandbox escape. The affected code is delivered as part of the Google Chrome browser (CPE cpe:2.3:a:google:chrome), and the description specifically scopes impact to the Android platform build, where AdFilter processes attacker-supplied page content during rendering.

RemediationAI

Vendor-released patch: update Google Chrome to 149.0.7827.201 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01245939337.html); on Android update via the Play Store and relaunch the browser to complete the update, and on Linux distributions apply the corresponding SUSE/Red Hat packaged Chromium updates when published. Because exploitation requires the user to load a malicious page and perform specific gestures, an effective interim compensating control is to enable Chrome's Enhanced Safe Browsing and 'Always use secure connections' and caution users against interacting with untrusted sites; in managed fleets, enterprises can enforce automatic browser updates via policy so the fix deploys without user action. No standalone workaround disables AdFilter safely, so patching is the primary remediation.