CVE-2026-13870

HighCVSS 8.8

Published: 30/06/2026(UTC)Updated: 02/07/2026(UTC)Translated: 03/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

38th percentile — higher than 38% of all known CVEs

Summary

A use-after-free vulnerability in WebView in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Risk Assessment

An attacker can remotely execute arbitrary code within the Chrome sandbox, potentially compromising user data confidentiality and integrity.

Recommendation

Update Google Chrome on Android to version 150.0.7871.47 or later immediately.

Original NVD description (English source)

Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)