CVE-2026-13038
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Use after free in Autofill in Google Chrome on Windows prior to version 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Risk Assessment
This vulnerability could lead to remote code execution, posing a significant security risk to user systems.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability.
Other vulnerabilities in Google Chrome Autofill
See all- CVE-2026-12020High
A use after free vulnerability in Autofill in Google Chrome on Mac prior to version 149.0.7827.115 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2026-12015Medium
Use after free in Autofill in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.
Original NVD description (English source)
Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)