CVE-2026-10014: Use after free in WebMIDI in Google Chrome on Android prior to 148

Synopsis

A use-after-free vulnerability affects the WebMIDI component of Google Chrome on Android in versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no prior authentication, but the attacker must have already compromised the renderer process and must trick a victim into visiting a crafted HTML page. Successful exploitation allows a sandbox escape, giving the attacker capabilities beyond the normally restricted renderer context including full read, write, and denial-of-service impact on the affected host. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to the victim's browser, requiring the vulnerable service to be reachable over the internet or an internal network.

• AuthenticationNot required

  No account or credential is needed; the attacker interacts with the target solely through the browser's handling of web content.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker must socially engineer or redirect the user to attacker-controlled content.

• Attack complexityDetail

  Attack complexity is High, meaning the attacker must first achieve renderer process compromise before the sandbox escape becomes possible, introducing a significant precondition beyond simply serving the malicious page.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside the Chrome renderer sandbox at a higher privilege level on the Android device.
• Confidentiality impact is High: the attacker reads data from memory regions and storage accessible to the elevated process, including session tokens and application data.
• Integrity impact is High: the attacker writes to or modifies data and system state outside the sandbox boundary.
• Availability impact is High: the attacker crashes or destabilizes the affected process or device, causing service disruption.