CVE-2026-9888: Use after free in WebView in Google Chrome on Android prior to 148

Synopsis

A use-after-free vulnerability exists in the WebView component of Google Chrome on Android, affecting all versions prior to 148.0.7778.216. The flaw is reachable over the network and requires no authentication, though it does require a victim to interact with attacker-controlled content and assumes the attacker has already compromised the renderer process. Successful exploitation enables a full sandbox escape, giving the attacker confidentiality, integrity, and availability impact beyond the browser's sandboxed process. A patched-image rebuild at version 148.0.7778.216 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network, requiring the victim's device to reach an attacker-controlled web resource.

• AuthenticationNot required

  No account or credential is needed; the attacker interacts with the target entirely through a crafted web page.

• Victim interactionRequired

  The victim must navigate to or otherwise load an attacker-crafted HTML page, requiring a social-engineering step to direct the victim to malicious content.

• Attack complexityDetail

  Exploitation is rated high complexity because it requires the attacker to have already compromised the renderer process before the use-after-free sandbox escape can be triggered, introducing a meaningful pre-condition beyond simply serving a page.

Blast Radius

• An attacker who triggers the sandbox escape reads data outside the WebView sandbox boundary, including session tokens, credentials, and application data stored by other processes.
• The attacker gains the ability to write or modify data accessible to the host process, including files, shared storage, and application state.
• The attacker can crash or destabilize processes outside the sandbox, causing the host application or dependent services to become unavailable.
• Because the scope is changed (S:C in the CVSS vector), impact extends beyond the browser process itself to other components sharing the Android device environment.