Is CVE-2026-12438 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12438 being exploited in the wild.

How severe is CVE-2026-12438?

High severity, with a CVSS score of 8.3, published 17 June 2026.

Which products and versions are affected?

Google Chrome for Android prior to 149.0.7827.155; Google WebView prior to 149.0.7827.155.

Is there a fix for CVE-2026-12438?

A patch was published on 2026-06-16: Stable channel update released for desktop and Android versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12438 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-12438?

Check whether you run Google Chrome for Android or Google WebView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12438: Google Chrome WebView sandbox escape on Android

CVE-2026-12438 · Severity: high · CVSS 8.3 · Published 2026-06-17

A security vulnerability exists in the WebView component of Google Chrome on Android, which is used by many mobile apps to display web content. An attacker who has already partially compromised the browser's internal processes could use a specially crafted webpage to break out of the security sandbox. If successful, this could allow the attacker to gain broader access to the underlying Android operating system and user data.

Technologies: Google Chrome for Android, Google WebView. Vendors: Google.

Quick answers

Is CVE-2026-12438 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12438 being exploited in the wild.
How severe is CVE-2026-12438?: High severity, with a CVSS score of 8.3, published 17 June 2026.
Which products and versions are affected?: Google Chrome for Android prior to 149.0.7827.155; Google WebView prior to 149.0.7827.155.
Is there a fix for CVE-2026-12438?: A patch was published on 2026-06-16: Stable channel update released for desktop and Android versions Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12438 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-12438?: Check whether you run Google Chrome for Android or Google WebView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as a protection mechanism failure (CWE-693) within the WebView component of Google Chrome for Android. The flaw allows a remote attacker who has already achieved code execution within a compromised renderer process to bypass sandbox restrictions. By enticing a user to visit a malicious HTML page, the attacker can escalate their privileges to escape the renderer sandbox and interact with the broader system. The vulnerability was addressed in version 149.0.7827.155. While the attack requires a high degree of complexity and an initial compromise, the impact is rated as critical due to the potential for full system compromise.

Affected products

Google Chrome for Android prior to 149.0.7827.155
Google WebView prior to 149.0.7827.155

Timeline

2026-05-27: other: Reported to Google by internal researchers
2026-06-16: patched: Stable channel update released for desktop and Android versions
2026-06-17: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.