CVE-2026-11163: Use after free in Messages in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability exists in the Messages component of Google Chrome on Android in versions prior to 149.0.7827.53. The flaw is reachable over the network without any authentication, but requires the victim to visit a crafted HTML page, making it a social-engineering-assisted attack. Successful exploitation allows a remote attacker to escape the Chrome sandbox and achieve high-impact compromise of confidentiality, integrity, and availability on the affected device. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by directing the victim to a crafted HTML page hosted remotely.

• AuthenticationNot required

  No account or credential is needed on the target service; the attack originates from an unauthenticated remote position.

• Victim interactionRequired

  The victim must visit or be redirected to a crafted HTML page, requiring a social-engineering step to trigger the use-after-free.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker escapes the Chrome renderer sandbox, breaking the primary isolation boundary between web content and the underlying Android OS.
• With sandbox escape achieved, the attacker reads sensitive data accessible to the Chrome process, including stored session tokens, saved credentials, and browsing history.
• The attacker writes or modifies data within the Chrome profile and any storage accessible post-escape, enabling persistent changes or malware installation.
• The attacker can crash or destabilize the Chrome process and dependent services, causing a denial of service on the affected device.