CVE-2026-12452: Use after free in Downloads in Google Chrome on Android prior to 149

Synopsis

A use-after-free vulnerability affects the Downloads component of Google Chrome on Android in versions prior to 149.0.7827.155. The flaw is reachable over the network without any authentication, but requires a user to visit a crafted HTML page. Successful exploitation corrupts heap memory and gives the attacker high-impact read, write, and availability control over the affected process, which can lead to arbitrary code execution. A patched-image rebuild at version 149.0.7827.155 is available on HarborGuard for environments running an affected version of Chrome on Android.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by serving a crafted HTML page to the victim's browser; no local or physical access is needed.

• AuthenticationNot required

  No account or credentials are required; any anonymous remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must navigate to or be redirected to the attacker-controlled HTML page, making this a social-engineering or drive-by delivery scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race conditions, or memory-layout knowledge to trigger.

Blast Radius

• Reads process memory, which may expose session tokens, cached credentials, and downloaded file contents held in the Chrome process heap.
• Writes to heap memory, allowing the attacker to corrupt internal data structures and redirect execution flow toward attacker-supplied code.
• Crashes or destabilizes the Chrome process on the affected Android device, disrupting browser availability for the user.
• On successful heap exploitation, the attacker gains code execution within the Chrome sandbox on Android, forming a foothold for further privilege escalation attempts.