CVE-2026-11131: Use after free in Autofill in Google Chrome on Android prior to 149

Synopsis

Use-after-free in the Autofill component of Google Chrome for Android (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by delivering a crafted HTML page. The vulnerability is reachable over the network, requires no authentication, but does require a victim to interact with attacker-controlled content. Successful exploitation gives the attacker full confidentiality, integrity, and availability impact outside the sandbox boundary. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the victim's device must be reachable to or browsing content from an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; the attack is launched through a page any unauthenticated user can visit.

• Victim interactionRequired

  The victim must open or navigate to the attacker-crafted HTML page, making this a social-engineering or malicious-link delivery scenario.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors, though it does assume the renderer process has already been compromised as a prerequisite.

Blast Radius

• An attacker who achieves sandbox escape reads arbitrary data from the device, including stored session tokens, saved passwords, and Autofill records held outside the Chrome sandbox.
• The attacker gains the ability to write to the filesystem and modify application data or install persistent payloads on the Android device.
• Full process availability outside the sandbox is compromised, allowing the attacker to crash or hang the host application and any dependent services.
• The scope of impact extends beyond the Chrome renderer process itself to the broader Android system context, consistent with the CVSS Changed Scope rating.