CVE-2026-11188: Use after free in USB in Google Chrome on Android prior to 149

Synopsis

Use-after-free in the USB component of Google Chrome on Android (versions prior to 149.0.7827.53) allows a remote attacker to exploit freed memory through a crafted HTML page delivered over the network, requiring no authentication but needing the victim to visit or interact with the malicious page. Successful exploitation enables a sandbox escape, giving the attacker read, write, and execution capabilities beyond the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version of Chrome on Android.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remotely accessible host.

• AuthenticationNot required

  No account or credential is needed on the target; the attacker only needs the victim to load the malicious page.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, making this a social-engineering vector such as a phishing link or malicious ad.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• Attacker escapes the Chrome browser sandbox, gaining code execution outside the browser process boundary.
• Confidential data accessible to the browser process, including session tokens, stored credentials, and on-device user data, is exposed to reads.
• Attacker can write to memory and filesystem regions outside the sandbox, enabling persistent modification of application data or installation of malicious payloads.
• The affected process can be crashed or destabilized, causing service disruption for the browser and any dependent in-app functionality.