Use-after-free in WebView in Google Chrome on Android

Successful exploitation allows arbitrary code execution within the Chrome/WebView sandbox on affected Android systems. Depending on attacker objectives, this can be used to compromise the renderer context, execute malicious logic in-process, and potentially facilitate follow-on actions such as data access within the sandboxed context, browser process abuse, or chaining with a separate sandbox escape or privilege-escalation vulnerability. Broader Chromium advisories also note that vulnerabilities in this release family could lead to denial of service or information disclosure, but the specific confirmed impact for CVE-2026-13037 is sandboxed arbitrary code execution.

Apply the vendor update as the primary mitigation. Until patching is complete, reduce exposure by limiting the loading of untrusted or attacker-controlled HTML content in affected Android WebView contexts and Chrome on Android. Enterprise defenders should prioritize rapid rollout of the fixed version because detailed technical information may become more available after broad deployment.

Upgrade Google Chrome on Android and the affected Android WebView component to version 149.0.7827.197 or later. For downstream Chromium consumers, apply the corresponding vendor-supplied patched release once available. On Debian-based Chromium deployments, apply the vendor security update for the chromium package where applicable. Because Google restricted exploit-relevant details at disclosure time, prompt patching is the primary remediation.