CVE-2026-11167: Inappropriate implementation in WebView in Google Chrome on Android prior to 149

Synopsis

A sandbox escape vulnerability exists in the WebView component of Google Chrome on Android in versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, though a victim must interact with a crafted HTML page; exploitation also requires that an attacker has already compromised the renderer process. Successful exploitation gives the attacker full read, write, and availability impact outside the WebView sandbox, effectively escaping the browser's isolation layer. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the affected service must be reachable from an external or remote origin.

• AuthenticationNot required

  No account or credential is needed; the attacker can target any user who browses to the malicious page.

• Victim interactionRequired

  The victim must visit or be directed to a crafted HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  The exploit is considered condition-free and reliable once the renderer process has been compromised, with no race conditions or memory-layout dependencies required at this stage.

Blast Radius

• An attacker who triggers the sandbox escape reads data stored outside the WebView sandbox, including credentials, session tokens, and local app storage belonging to the host application.
• The attacker writes to or modifies files and application state beyond the WebView boundary, enabling persistent tampering with the host Android application.
• The attacker can crash or disrupt the host process and any services it manages, causing denial of service for the application.
• Because scope is changed (S:C in the CVSS vector), impact extends beyond the vulnerable component itself to other components sharing the same device context.