CVE-2026-12448: Inappropriate implementation in WebView in Google Chrome on Android prior to 149

Synopsis

An inappropriate implementation flaw in the WebView component of Google Chrome on Android (versions prior to 149.0.7827.155) allows a remote attacker to escalate privileges by delivering a crafted HTML page to a victim. The attack requires no authentication but does require the victim to visit or interact with the malicious page, making it a network-reachable, user-assisted exploit. Successful exploitation gives the attacker high-impact control over confidentiality, integrity, and availability of the affected process. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the vulnerable service or browser session must be reachable from the attacker's origin.

• AuthenticationNot required

  No account or credential of any kind is required; the attack works against any unauthenticated user who loads the page.

• Victim interactionRequired

  The victim must visit or be directed to the attacker-controlled HTML page, requiring a social-engineering or redirect step to succeed.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites beyond getting the victim to load the page.

Blast Radius

• A successful attacker escalates privileges within the Chrome WebView sandbox, gaining the ability to read sensitive data stored or processed by the WebView context, including session tokens, cookies, and locally cached content.
• The attacker can write or modify data accessible to the escalated privilege level, including injecting content into the WebView or altering application state.
• The attacker can crash or deny service to the affected WebView process, disrupting the Android application relying on it.
• Because all three CVSS impact dimensions are rated High, the attacker effectively achieves full compromise of confidentiality, integrity, and availability within the affected component boundary.