CVE-2026-13038 is a use-after-free vulnerability in the Autofill feature of Google Chrome on Windows platforms before version 149.0.7827.197. Exploitation requires user interaction (visiting a maliciously crafted HTML page) and can lead to remote code execution. The vulnerability is rated critical by Chromium security with a CVSS 3.1 base score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication. The vendor has published an advisory indicating a stable channel update addressing this issue in version 149.0.7827.197.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on affected systems, potentially leading to full compromise of the user's environment. The vulnerability affects confidentiality, integrity, and availability of the system. No known active exploitation has been reported.

A fixed version is available: Google Chrome version 149.0.7827.197 addresses this vulnerability. Users and administrators should update to this version or later to mitigate the risk. The vendor advisory confirms the availability of this update. No additional mitigation steps are specified.