CVE-2026-11072: Use after free in WebView in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability affects the WebView component in Google Chrome on Android prior to version 149.0.7827.53. The flaw is reached locally and requires no authentication, though a victim must open a malicious file, which triggers the memory corruption. Successful exploitation gives an attacker arbitrary code execution on the device. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No account or credentials are required; the attacker needs only local access to the device.

• Victim interactionRequired

  The victim must open or interact with a malicious file, making social engineering a necessary part of the attack path.

• Attack complexityDetail

  Exploit conditions are reliable and essentially condition-free once the malicious file is opened, with no race conditions or special memory layout requirements needed.

Blast Radius

• Successful exploitation gives the attacker arbitrary code execution in the context of the Chrome process on the Android device.
• Confidential data accessible to the Chrome process, including stored credentials, browsing history, and cookies, can be read directly.
• The attacker can modify or delete application data, session state, and files accessible to the Chrome process.
• The affected Chrome process can be crashed or forced into an unrecoverable state, disrupting the user's browsing session and any dependent functionality.