CVE-2026-11010: Use after free in WebShare in Google Chrome on Android prior to 149

Synopsis

Use-after-free in the WebShare component of Google Chrome for Android (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox via a crafted HTML page. The vulnerability is reachable over the network and requires the victim to visit a malicious page, but no authentication is needed. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox, effectively achieving code execution at the OS process level. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted device must be reachable from or browsing to an internet-accessible origin.

• AuthenticationNot required

  No account or credential is needed; any user who browses to the attacker-controlled page is a viable target.

• Victim interactionRequired

  The victim must open a crafted HTML page, meaning the attacker depends on social engineering or a malicious link to trigger exploitation.

• Attack complexityDetail

  Attack complexity is HIGH, meaning the attacker must already have compromised the renderer process before the sandbox escape primitive can be leveraged, introducing a prerequisite step beyond simply serving the page.

Blast Radius

• A successful sandbox escape lets the attacker read arbitrary data from the device, including stored credentials, session tokens, and application data outside the Chrome sandbox.
• The attacker gains the ability to write or modify files and data accessible to the process that Chrome runs under on the Android device.
• The attacker can crash or disrupt the Chrome process and any services accessible from that process context.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser sandbox to other components sharing the Android OS environment.