Executive brief
A vulnerability exists in the WebView component of Google Chrome for Android, which is used by many mobile apps to display web content. By tricking a user into visiting a specially crafted website, an attacker could cause the application to crash or potentially execute unauthorized actions. This could lead to the compromise of sensitive data handled within the affected Android application.
Technical details
A use-after-free (UAF) vulnerability exists in the WebView component of Google Chrome for Android prior to version 149.0.7827.53. The flaw is triggered when the application incorrectly manages memory during the processing of HTML content, leading to heap corruption. A remote, unauthenticated attacker can exploit this by inducing a user to load a malicious HTML page. Successful exploitation could lead to arbitrary code execution within the context of the sandboxed renderer process or a denial-of-service (browser crash). The issue is tracked as CWE-416 and has been addressed in the stable channel update.
Affected products
- Google Chrome WebView prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Stable channel update released for desktop and mobile components.
- 2026-06-04: disclosed: CVE-2026-11080 published.