CVE-2026-13282 is a use-after-free vulnerability in the Payments feature of Google Chrome on Android devices before version 149.0.7827.201. This vulnerability allows a local attacker with physical access to potentially cause heap corruption, which could lead to arbitrary code execution or other impacts. The CVSS v3.1 base score is 6.8, reflecting medium severity with attack vector as physical access, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no explicit vendor advisory content detailing patch status or remediation level, but the affected version is prior to 149.0.7827.201, implying that updating to this version or later addresses the issue.

The vulnerability can be exploited by a local attacker with physical access to the affected Android device running Chrome versions prior to 149.0.7827.201. Successful exploitation may result in heap corruption, potentially leading to arbitrary code execution or compromise of confidentiality, integrity, and availability of the device. No known exploits in the wild have been reported.

Update Google Chrome on Android to version 149.0.7827.201 or later to remediate this vulnerability. Since this is a client-side application and not a cloud service, applying the update is necessary to mitigate the risk. Patch status is inferred from the affected version information; check the official Google Chrome release blog for confirmation and further guidance.