CVE-2026-13028: Use after free in WebGL in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability in the WebGL component of Google Chrome for Android allows a remote attacker to exploit freed memory via a crafted HTML page. The attack is reachable over the network, requires no authentication, but does need the victim to visit a malicious page; the CVSS scope change (S:C) reflects that successful exploitation can break out of the browser sandbox. A successful attacker gains full confidentiality, integrity, and availability impact on the host and a patched-image rebuild at version 149.0.7827.197 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to the victim's browser, so the service must be reachable remotely.

• AuthenticationNot required

  No account or credential is needed; any user who browses to the malicious page is a viable target.

• Victim interactionRequired

  The victim must visit the attacker-controlled HTML page, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors outside the attacker's control.

Blast Radius

• A successful attacker reads arbitrary data from the browser process memory, including stored session tokens, cookies, and cached credentials.
• The attacker writes or modifies data within the browser process and, via sandbox escape, can alter files or state accessible to the browser on the host.
• The sandbox escape extends impact beyond the Chrome renderer, giving the attacker a foothold at the Android application or OS process level depending on device privilege boundaries.
• The attacker can crash the browser process or destabilize host services, causing denial of service for the affected user session.