CVE-2026-10959: Use after free in Input in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability in the Input component of Google Chrome for Android (versions before 149.0.7827.53) allows a remote attacker to execute arbitrary code inside the browser sandbox by serving a crafted HTML page. The attacker operates over the network and requires no authentication, but does need the victim to visit a malicious page. Successful exploitation gives the attacker arbitrary code execution within the Chrome sandbox, enabling data access, content tampering, and potential sandbox-escape chaining. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim's Chrome browser to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account, credential, or session token is required; any user browsing to the malicious page is a viable target.

• Victim interactionRequired

  The victim must visit the attacker-crafted HTML page, making this a social-engineering vector that requires the victim to take an action such as clicking a link.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• The attacker executes arbitrary code inside the Chrome renderer sandbox on the victim's Android device, gaining control over the browser process.
• Confidential data accessible to the browser, including stored credentials, session cookies, and page content from other origins, can be read.
• The attacker can modify or inject content into pages rendered by the compromised process, enabling in-browser data tampering.
• If combined with a sandbox-escape primitive, the attacker can extend access beyond the browser to the underlying Android OS process context.