CVE-2026-11080: Use after free in WebView in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability affects the WebView component in Google Chrome on Android prior to version 149.0.7827.53. The flaw is reachable over the network without any authentication, but requires a victim to visit a crafted HTML page. Successful exploitation corrupts heap memory, giving an attacker the ability to read sensitive data, modify application state, or crash the browser process. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted on an attacker-controlled server.

• AuthenticationNot required

  No account or credentials on the target system are needed; any anonymous remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making social engineering or a malicious link a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads in-process memory, which may include session tokens, cookies, and other credential material stored in the browser.
• The attacker can modify heap data within the Chrome process, enabling tampering with page content, cached responses, or persisted application state.
• The vulnerability can be used to crash the Chrome WebView process, causing a denial of service for any Android application that embeds WebView.
• Given the combination of high confidentiality, integrity, and availability impact, the exploit may serve as a stepping stone toward full remote code execution within the application sandbox.