Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
3192 articles · 168085 vulns · 37/41 feeds (7d)
← Back to list
8.8
CVE-2026-13038EXPLOITEDPATCHED
google · chrome

CVE-2026-13038: Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbi

Description

Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Affected Products

VendorProductVersions
googlechrome149.0.7827.197

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
googlechromecert_advisory90%
microsoftwindowscve_cpe95%

References

  • https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html
  • https://issues.chromium.org/issues/523740781

Related News (5 articles)

Tier A
Microsoft MSRC1d ago
Chromium: CVE-2026-13038 Use after free in Autofill
→ No new info (linked only)
Tier D
Heise Security1d ago
Chrome: Zwei Updates in einer Woche
→ No new info (linked only)
Tier B
BSI Advisories2d ago
[NEU] [hoch] Google Chrome: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
→ No new info (linked only)
Tier B
CERT-FR3d ago
Multiples vulnérabilités dans Google Chrome (25 juin 2026)
→ No new info (linked only)
Tier C
VulDB3d ago
CVE-2026-13038 | Google Chrome up to 149.0.7827.155 on Windows Autofill use after free
→ No new info (linked only)
CVSS 3.18.8 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA KEV❌ No
Actively exploited✅ Yes
Patch available
149.0.7827.197
CWECWE-416
PublishedJun 24, 2026
Last enriched1d agov3
Trending Score65
Source articles5
Independent5
Info Completeness10/14
Missing: epss, kev, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-13033EXP
CVE-2026-13033: Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker
Trending: 65
HIGHCVE-2026-13027EXP
CVE-2026-13027: Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit h
Trending: 62
HIGHCVE-2026-13025EXP
CVE-2026-13025: Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer pro
Trending: 62
HIGHCVE-2026-13031EXP
CVE-2026-13031: Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code ins
Trending: 62
HIGHCVE-2026-13026EXP
CVE-2026-13026: Use after free in Digital Credentials in Google Chrome on Mac prior to 149.0.7827.197 allowed a remote attacker to poten
Trending: 62

Pin to Dashboard

Verification

State: unverified
Confidence: 0%

Vulnerability Timeline

CVE Published
Jun 24, 2026
Discovered by ZDM
Jun 24, 2026
Updated: affectedVersions, severity
Jun 24, 2026
Actively Exploited
Jun 25, 2026
Exploit Available
Jun 25, 2026
Patch Available
Jun 25, 2026
Updated: exploitAvailable, activelyExploited
Jun 26, 2026

Version History

v3
Last enriched 1d ago
v3Tier A1d ago

Updated exploit availability to true and marked the vulnerability as actively exploited.

exploitAvailableactivelyExploited
via Microsoft MSRC
v2Tier C3d ago

Updated affected versions to include 149.0.7827.155 and changed severity to CRITICAL.

affectedVersionsseverity
via VulDB
v13d ago

Initial creation