Quick answers
- Is CVE-2026-13037 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13037 being exploited in the wild.
- How severe is CVE-2026-13037?
- Informational severity, published 24 June 2026.
- Which products and versions are affected?
- Google Android WebView prior to 149.0.7827.197; Google Chrome for Android prior to 149.0.7827.197.
- Is there a fix for CVE-2026-13037?
- A patch was published on 2026-06-23: Stable channel update released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13037 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-13037?
- Check whether you run Google Android WebView or Google Chrome for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A use-after-free (UAF) vulnerability exists in the WebView component of Google Chrome on Android (CWE-416). The flaw is triggered when the application attempts to access memory that has already been freed, which can be induced by a specially crafted HTML page. A remote attacker can exploit this to execute arbitrary code within the context of the browser's sandbox. The vulnerability was addressed in version 149.0.7827.197. While the NVD description mentions a 'local' attacker, the primary vector for crafted HTML pages in a browser context is typically remote/network-based.
Affected products
- Google Chrome for Android prior to 149.0.7827.197
- Google Android WebView prior to 149.0.7827.197
Timeline
- 2026-06-14: other: Reported to Chrome by Google researchers
- 2026-06-23: patched: Stable channel update released
- 2026-06-24: disclosed: CVE published