Loading vulnerability…
Use-after-free in Google Chrome Autofill
CVE-2026-13038 is a critical use-after-free vulnerability in the Autofill component of Google Chrome on Windows before version 149.0.7827.197. The flaw is triggered when Chrome processes attacker-controlled web content delivered through a crafted HTML page, leading to a stale object being accessed after it has been freed. Because the vulnerable component is Autofill, the bug resides in browser logic associated with handling stored form data and related form-completion functionality. Successful exploitation can corrupt memory and enable arbitrary code execution in the browser process.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a remote attacker to achieve arbitrary code execution on an affected Windows system in the context of the browser by luring a target to open a crafted HTML page. As a use-after-free condition, the vulnerability can also cause browser instability or crashes, and depending on post-exploitation conditions may contribute to broader system compromise.
If you can’t patch tonight, do this now.
Apply the available browser security updates as soon as possible. Where immediate patching is not feasible, reduce exposure by limiting use of untrusted websites and untrusted HTML content on affected Windows Chrome installations until updates are deployed. No alternative vendor workaround beyond upgrading has been provided.
Patch, then assume compromise.
Upgrade Google Chrome on Windows to version 149.0.7827.197 or later. Chromium-based downstream products should also be updated to vendor releases that incorporate the Chromium 149.0.7827.197 fix or later. For Debian chromium deployments, apply the vendor-provided patched package version or a later security-updated release. For Microsoft Edge, upgrade to version 149.0.4022.96 or later.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.