CVE-2026-10953: Use after free in Core in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability in the Core component of Google Chrome for Android affects all versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the attacker must have already compromised the renderer process and must trick a victim into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker capabilities beyond the Chrome sandbox including access to confidential data, modification of data, and disruption of availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credentials are required; the attacker interacts with the browser as any anonymous remote party.

• Victim interactionRequired

  The victim must visit a crafted HTML page, requiring a social-engineering step such as a phishing link or malicious redirect.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must have already compromised the renderer process before the use-after-free primitive can be used to escape the sandbox.

Blast Radius

• A successful attacker escapes the Chrome sandbox and gains execution context with privileges beyond the renderer, able to read sensitive data stored on the device including session tokens and personal files.
• The attacker can write to or modify data accessible outside the sandbox, including application storage and potentially system-level resources.
• The attacker can crash or destabilize services running outside the Chrome sandbox, causing denial of availability.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser process itself to other components on the Android device.