CVE-2026-10967: Use after free in SurfaceCapture in Google Chrome on Android prior to 149

Synopsis

Use-after-free in the SurfaceCapture component of Google Chrome on Android (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the Chrome renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, but does require the victim to interact with attacker-controlled content, and the attacker must already hold a foothold in the renderer. Successful exploitation grants full confidentiality, integrity, and availability impact beyond the sandbox boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page, so the affected device must be reachable or must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credential is needed; the attacker operates as an anonymous remote party.

• Victim interactionRequired

  The victim must visit or interact with a crafted HTML page, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Exploitation is rated AC:H, meaning the attacker must first achieve a renderer-process compromise before this use-after-free can be leveraged for a sandbox escape, introducing a significant environmental dependency.

Blast Radius

• A successful sandbox escape lets the attacker execute arbitrary code outside the Chrome sandbox with the privileges of the Android application process.
• Confidentiality impact is high: the attacker reads data accessible to the Chrome process, including stored credentials, session tokens, and browsing history on the device.
• Integrity impact is high: the attacker writes or modifies files and data within the scope of the Chrome process and potentially broader Android storage permissions.
• Availability impact is high: the attacker crashes or hangs the browser process and may destabilize dependent system services on the affected Android device.