CVE-2026-13028
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk12th percentile — higher than 12% of all known CVEs
Summary
A use-after-free vulnerability in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Risk Assessment
The risk for the organization is the possibility of gaining control over the browser process and escaping the sandbox, which could lead to further privilege escalation on the system.
Recommendation
It is recommended to immediately update Google Chrome on Android devices to version 149.0.7827.197 or later.
Original NVD description (English source)
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)