# CVE-2026-9888: Google Chrome WebView use after free sandbox escape

Source: https://junglewise.ai/threats/cve-2026-9888-google-chrome-webview-use-after-free-sandbox-escape  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-9888 · Severity: info · Published 2026-05-28

A critical security vulnerability exists in Google Chrome for Android and the WebView component, which is used by many Android apps to display web content. An attacker who has already partially compromised the browser's internal processes could use a specially crafted website to break out of the security sandbox. This could allow the attacker to gain broader access to the device, potentially compromising user data or system integrity.

Technologies: [Google Chrome for Android](https://junglewise.ai/threats/technologies/chrome-for-android), [Google WebView](https://junglewise.ai/threats/technologies/webview). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-9888 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9888 being exploited in the wild.

**How severe is CVE-2026-9888?** Informational severity, published 28 May 2026.

**Which products and versions are affected?** Google Chrome for Android Prior to 148.0.7778.216; Google WebView Prior to 148.0.7778.216.

**Is there a fix for CVE-2026-9888?** A patch was published on 2026-05-27: Stable channel update released for desktop/Android versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9888 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-9888?** Check whether you run Google Chrome for Android or Google WebView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the WebView component of Google Chrome for Android prior to version 148.0.7778.216. The flaw is categorized under CWE-416 and occurs when the application continues to use a pointer after it has been freed. To exploit this, a remote attacker must first compromise the renderer process. Once achieved, the attacker can leverage a crafted HTML page to trigger the UAF condition and potentially perform a sandbox escape. This would allow the attacker to execute code outside of the restricted browser environment. Google has addressed this in the stable channel update for Android.

## Affected products

- Google Chrome for Android Prior to 148.0.7778.216
- Google WebView Prior to 148.0.7778.216

## Timeline

- 2026-05-27: patched: Stable channel update released for desktop/Android versions.
- 2026-05-28: disclosed: CVE published to NVD.

## References

- [https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html](https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html)
- [https://issues.chromium.org/issues/511715166](https://issues.chromium.org/issues/511715166)

## Related threats

- [Google Chrome WebView sandbox escape via improper input validation](https://junglewise.ai/threats/cve-2026-17741-google-chrome-webview-sandbox-escape-via-improper-input)
- [Google Chrome for Android use after free in WebView](https://junglewise.ai/threats/cve-2026-13037-google-chrome-for-android-use-after-free-in-webview)
- [Google Chrome WebView privilege escalation on Android](https://junglewise.ai/threats/cve-2026-12448-google-chrome-webview-privilege-escalation-on-android)
- [Google Chrome WebView sandbox escape on Android](https://junglewise.ai/threats/cve-2026-12438-google-chrome-webview-sandbox-escape-on-android)
- [Google Chrome for Android navigation bypass in Reader Mode](https://junglewise.ai/threats/cve-2026-11297-google-chrome-for-android-navigation-bypass-in-reader-mode)