CVE-2026-10923: Use after free in WebAppInstalls in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability affects Google Chrome on Android versions prior to 149.0.7827.53 in the WebAppInstalls component. The flaw is reachable over the network but requires a user to interact with a malicious file, and no authentication is needed to trigger it. Successful exploitation gives an attacker arbitrary code execution on the affected device. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious file over the network, so the targeted device must be reachable or the user must be able to reach attacker-controlled content across the network.

• AuthenticationNot required

  No account or credential is needed; the attacker does not need to authenticate to any service to deliver the exploit.

• Victim interactionRequired

  A user must open or interact with a malicious file, making this a social-engineering vector where the attacker must convince the victim to take an action.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary attacker-controlled code in the context of the Chrome process on the affected Android device.
• Reads sensitive data accessible to the Chrome process, including stored credentials, session tokens, and browsing data.
• Modifies or deletes data accessible to the Chrome process, including locally cached files and app storage.
• Crashes or destabilizes the Chrome process, disrupting the user's browsing session and any web app functionality running within it.