CVE-2026-12438: Inappropriate implementation in WebView in Google Chrome on Android prior to 149

Synopsis

This is a sandbox escape vulnerability in Google Chrome's WebView component on Android, affecting all versions prior to 149.0.7827.155. An attacker who has already compromised the renderer process can reach this flaw over the network by serving a crafted HTML page to a victim who visits it, without needing any credentials. Successful exploitation breaks out of the renderer sandbox, granting the attacker full confidentiality, integrity, and availability impact on the affected system. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by serving a crafted HTML page from a remote location.

• AuthenticationNot required

  No credentials or account are needed; the attacker exploits the flaw through a page the victim visits.

• Victim interactionRequired

  The victim must visit or be directed to the attacker-controlled HTML page, making social engineering a prerequisite.

• Attack complexityDetail

  Exploitation is rated high complexity, meaning the attacker must first have compromised the renderer process before leveraging this flaw to escape the sandbox.

Blast Radius

• A successful sandbox escape lets the attacker execute code outside the Chrome renderer sandbox, breaking the primary isolation boundary on the Android device.
• The attacker reads any data accessible to the browser process, including stored credentials, session tokens, and cached page content.
• The attacker modifies files, cookies, or stored application data that the browser process can reach on the device.
• The attacker can crash or disrupt the browser process and any dependent services, causing a denial of service for the affected user.