Executive brief
Google Chrome's WebView component on Android contains a memory safety flaw that allows attackers to read memory outside of sandbox boundaries. An attacker who has already compromised the browser's renderer process can exploit this via a malicious HTML page to access sensitive data from other parts of the system.
Technical details
This is an out-of-bounds read vulnerability in WebView, a critical browser component used to display web content in Android apps. The vulnerability exists in versions prior to 153.0.8010.36 and requires the attacker to have already compromised the renderer process—a prerequisite that suggests this could be chained with other exploits. A remote attacker can craft a malicious HTML page that triggers the out-of-bounds read, allowing them to exfiltrate memory from outside the sandbox's normal protection boundaries. The fix is available in Chrome 153.0.8010.36 and later versions.
Affected products
- Google Chrome prior to 153.0.8010.36 on Android
Timeline
- 2026-09-09: disclosed
- 2026-09-08: patched: Chrome 153.0.8010.36 released