CVE-2026-13028 is a use-after-free vulnerability in the WebGL implementation of Google Chrome on Android. It affects versions prior to 149.0.7827.197. Exploitation of this vulnerability could enable a remote attacker to perform a sandbox escape via a crafted HTML page, potentially compromising the security boundaries of the browser environment. The vulnerability is marked critical by Chromium security. No CVSS score is provided. The vendor advisory linked does not explicitly state the patch status or remediation details.

Successful exploitation may allow a remote attacker to escape the Chrome sandbox on Android devices, potentially leading to execution of arbitrary code or further compromise beyond the browser sandbox. This elevates the severity of the vulnerability to critical due to the potential for significant security impact on affected devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory URL is provided and should be monitored for updates on official fixes or mitigation steps. Until an official fix is confirmed, users should exercise caution when browsing untrusted content on affected versions.