CVE-2026-10932: Use after free in UI in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability affects Google Chrome on Android in versions prior to 149.0.7827.53. The flaw is reachable over the network with no authentication required, but the victim must visit a crafted HTML page that the attacker controls or has injected content into. Successful exploitation causes heap corruption and gives the attacker full read, write, and crash capabilities within the browser process. A patched-image rebuild at 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing or redirecting the victim to a crafted HTML page hosted on an attacker-controlled origin.

• AuthenticationNot required

  No account or credential of any kind is required; any anonymous network request that reaches the victim's browser is sufficient to deliver the payload.

• Victim interactionRequired

  The victim must open or be redirected to the attacker's crafted HTML page in Chrome on Android, making this a social-engineering or malicious-ad delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker reads memory contents of the Chrome browser process, including stored session tokens, cookies, and in-page credentials.
• The attacker writes to heap memory, enabling modification of browser state and potentially pivoting to further exploitation of the renderer or OS sandbox.
• The attacker can crash the Chrome browser process, disrupting the user's session and any active web application relying on it.
• All three impacts (confidentiality, integrity, and availability) are rated HIGH in the CVSS vector, so the attacker gains the full range of capabilities without partial limitations.