CVE-2026-11647: Use after free in Printing in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability exists in the Printing component of Google Chrome on Android, affecting versions prior to 149.0.7827.103. The flaw is reachable over the network but requires the attacker to have already compromised the Chrome renderer process and to lure a victim into visiting a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker code execution outside the renderer's security boundary with high impact on confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.103 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page, making network exposure a prerequisite.

• AuthenticationNot required

  No authentication is required; the attacker needs only to direct the victim to a malicious page.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on a social-engineering or redirect step to trigger the vulnerability.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already independently compromised the Chrome renderer process before this flaw can be leveraged for a sandbox escape.

Blast Radius

• Achieves a sandbox escape, breaking out of Chrome's renderer isolation boundary on the affected Android device.
• Reads sensitive data accessible to the elevated process context, including stored credentials, session tokens, and local application data.
• Modifies files and application state outside the renderer sandbox, enabling persistent tampering with device storage or installed app data.
• Crashes or destabilizes the Chrome process or dependent system services, disrupting availability for the affected user.