CVE-2026-12442: Use after free in Passwords in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability in the Passwords component of Google Chrome on Android affects all versions prior to 149.0.7827.155. The flaw is reachable over the network without any authentication, though it requires the victim to visit a specially crafted HTML page. Successful exploitation gives a remote attacker full arbitrary code execution on the affected device. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the victim over the network by inducing them to load a crafted page served from an attacker-controlled or compromised host.

• AuthenticationNot required

  No account or credentials on the target system are needed; the attack is launched purely through a malicious HTML page delivered to the browser.

• Victim interactionRequired

  The victim must open or be redirected to a crafted HTML page, making this a social-engineering or drive-by scenario that depends on user action.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim loads the page, with no race conditions or specific memory-layout requirements to satisfy.

Blast Radius

• The attacker gains arbitrary code execution in the context of the Chrome process on the victim's Android device.
• All data accessible to the browser, including saved passwords, session cookies, and locally cached content, is exposed for reading.
• The attacker can write or modify browser-managed storage, including saved credentials and browsing data.
• The affected Chrome process can be crashed or the broader device destabilized, disrupting access to the browser and any services it is authenticating against.