CVE-2026-10934: Use after free in Autofill in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability exists in the Autofill component of Google Chrome on Android, affecting versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the attacker must have already compromised the renderer process and must trick a victim into visiting a crafted HTML page. Successful exploitation allows a full sandbox escape, giving the attacker read, write, and crash capability outside the Chrome sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected device must be reachable or the victim must browse to an attacker-controlled URL.

• AuthenticationNot required

  No account or credential is needed; the attack is launched from an unauthenticated remote position via a malicious web page.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or a malicious link a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must already have compromised the Chrome renderer process before the use-after-free can be leveraged for a sandbox escape.

Blast Radius

• Reads sensitive data held in memory outside the Chrome sandbox, including stored credentials, session tokens, and page contents from other origins.
• Writes to memory outside the sandbox, allowing the attacker to modify application state or inject code into the host process.
• Crashes or destabilizes the host application or underlying Android process if exploitation is unsuccessful or used deliberately for denial-of-service.
• Achieves code execution at a privilege level beyond the sandboxed renderer, potentially enabling further device compromise.