CVE-2026-130388.8HighCWE-416

CVE-2026-13038: Google Chrome vulnerability

Google · Chrome

Vendor fix available · Affected: Google Chrome · Exploitation: not established

ExploitationNot established

Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)

In CISA KEV: not seen
Exploited (reported): not seen
Scanning observed: not seen
Proof of concept public: not seen
Not establishedNothing in the sources we check

0.4%probability of exploitation in the next 30 days

32nd percentile

050100

Higher than 32% of scored CVEs

8.8HighCVSS

LowMediumHighCrit.

DescriptionNVD

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Use After Free · Memory Corruption
Vendor: Google
Published: June 2026
Band: Unlikely (under 1%), June 2026

Coverage1 article · 1 outlet

First in our coverage: SecurityOnline, 25 Jun.

25 Jun 02:16
Chrome patches critical WebGL, Blink and Autofill flaws in update
SecurityOnline · first in our coverage · mentions it in passing

New articles also arrive in the RSS feed.