Description
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-24
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free flaw exists in the WebView component of Google Chrome on Android. A crafted HTML page can trigger an invalid memory reference, allowing a local attacker to execute arbitrary code inside Chrome’s sandbox process. The vulnerability is classified as high severity by Chromium security and is identified as CWE‑416, a consequential memory misuse that can lead to arbitrary code execution.

Affected Systems

The flaw affects Google Chrome on Android running versions prior to 149.0.7827.197. No specific branch or release outside of Android is known to be impacted. Users of the latest desktop Chrome releases are not affected by this particular bug.

Risk and Exploitability

Because the vulnerability requires a local attacker with access to render a malicious HTML page, the attack vector is local. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known active exploits at this time. However, the CVSS score of 7.8, reflecting a high severity rating, suggests that if an attacker gains the local execution capability, they could escape the sandbox and compromise the host system. The patch is available only in newer Chrome releases for Android.

Generated by OpenCVE AI on June 24, 2026 at 22:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome on Android to the latest patched version that includes WebView fixes (at least 149.0.7827.198 or higher).
  • If an immediate update is not possible, configure Chrome to disallow loading of local files into WebView (disable file:// or data: schemes) to reduce the attack surface.
  • Continuously monitor official Google Chrome release notes and security advisories for ongoing patches and workarounds, and apply them promptly.

Generated by OpenCVE AI on June 24, 2026 at 22:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4654-1 chromium security update
Debian DSA Debian DSA DSA-6364-1 chromium security update
History

Thu, 25 Jun 2026 06:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 24 Jun 2026 23:00:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome WebView Enabling Local Code Execution

Wed, 24 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
Title Use‑After‑Free in Chrome WebView Enabling Local Code Execution

Wed, 24 Jun 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 24 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Description Use after free in WebView in Google Chrome on Android prior to 149.0.7827.197 allowed a local attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-25T03:55:54.299Z

Reserved: 2026-06-23T17:14:12.890Z

Link: CVE-2026-13037

cve-icon Vulnrichment

Updated: 2026-06-24T19:21:09.253Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-25T06:00:05Z

Weaknesses