Loading vulnerability…
Use-after-free in WebGL in Google Chrome on Android
CVE-2026-13032 is a critical use-after-free vulnerability in the WebGL component of Google Chrome on Android before version 149.0.7827.197. The flaw can be triggered by remote web content delivered through a crafted HTML page. The vulnerable condition arises from incorrect lifetime management of memory in WebGL, creating a stale reference scenario in which freed memory may be reused while still accessible to code paths in the rendering pipeline. Google indicated that successful exploitation could potentially lead to a browser sandbox escape.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation could allow a remote attacker to move beyond a renderer-context memory corruption condition and potentially achieve a sandbox escape on affected Android Chrome installations. Depending on exploit reliability and post-corruption control, this could enable arbitrary code execution outside the intended browser sandbox boundary, broader compromise of the affected application context, or other severe security restriction bypass outcomes.
If you can’t patch tonight, do this now.
Apply the vendor security update as soon as possible. Until patched, reduce exposure by limiting use of untrusted web content on affected Android Chrome versions and, where operationally feasible, restricting access to potentially malicious sites or web applications. No specific vendor-provided workaround other than updating is currently available.
Patch, then assume compromise.
Upgrade Google Chrome on Android to version 149.0.7827.197 or later. More broadly, ensure Chromium-based downstream products incorporate the corresponding upstream fix once available. Standard patch management should prioritize this issue due to its critical severity and stated sandbox-escape potential.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.