CVE-2026-11012: Use after free in Serial in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability exists in the Serial component of Google Chrome on Android, affecting versions prior to 149.0.7827.53. The vulnerability is reachable over the network but requires the attacker to have already compromised the renderer process and to trick the user into visiting a crafted HTML page; CVSS v3.1 scores this 8.3 HIGH with changed scope, meaning a successful exploit breaks out of Chrome's sandbox and gains capabilities beyond the browser process itself. Exploitation allows an attacker to read, modify, or disrupt resources outside the renderer sandbox, effectively achieving a full sandbox escape. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome on Android.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the targeted device must be reachable by or directed to an attacker-controlled web resource.

• AuthenticationNot required

  No account or credential is needed; the attacker only needs the victim to load a page, with no authentication barrier on the attacker side.

• Victim interactionRequired

  The victim must navigate to or be redirected to a crafted HTML page, making social engineering or malicious-ad delivery a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must also have pre-compromised the Chrome renderer process before this use-after-free can be leveraged for a sandbox escape, introducing a significant environmental prerequisite.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, gaining code-execution capabilities in a more privileged process context on the Android device.
• With sandbox escape achieved, the attacker can read sensitive data stored outside the renderer, including cookies, stored credentials, and local files accessible to the browser process.
• The attacker can modify data or state outside the sandbox, including writing to storage or injecting into other browser or system processes.
• The attacker can crash or destabilize system-level components beyond the renderer, potentially disrupting device availability or other running applications.