Loading vulnerability…
WebGL use-after-free in Google Chrome for Android
CVE-2026-13028 is a use-after-free vulnerability in the WebGL component of Google Chrome for Android before version 149.0.7827.197. Processing a specially crafted HTML page can trigger the vulnerability, potentially allowing a remote attacker to escape the browser sandbox. The specific vulnerable function and memory-lifetime failure are not publicly detailed.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could bypass browser sandbox isolation on affected Android installations. Arbitrary code execution, data disclosure, denial of service, and full system compromise are not individually established for this vulnerability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by limiting use of untrusted web content on affected Android Chrome installations until the update is applied. Enterprise defenders can temporarily restrict browser use to trusted sites, enforce rapid browser update policies, and monitor for abnormal browser crashes associated with WebGL content. No vendor-provided workaround was identified as a complete substitute for patching.
Patch, then assume compromise.
Upgrade Google Chrome for Android to version 149.0.7827.197 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.