Use after free in WebAppInstalls in Google Chrome on Android prior to 149

CVE-2026-10923 is a use-after-free in Chrome's WebAppInstalls component on Android, affecting versions before 149.0.7827.53. Per the published CVE record, exploitation requires a local attacker and a malicious file, with the outcome being arbitrary code execution in Chrome's context on the device.

Chromium tags the bug High internally, which is fair from a pure memory-corruption standpoint, but in enterprise reality this lands lower. The decisive friction is the attacker position: this is not unauthenticated remote web exploitation, it is post-delivery / local-on-device abuse on one platform, and Chrome's sandbox further limits blast radius unless the attacker already has another bug or an existing foothold.

Why this verdict

• Local-only prerequisite cuts the population hard: this is not unauthenticated remote exploitation from the internet; it assumes the attacker already has device access or another delivery foothold.
• Malicious-file trigger adds another gate: the attacker needs file placement and likely user or local-process interaction to reach the vulnerable path, which is materially harder than a drive-by web page.
• Android-only scope narrows enterprise blast radius: even in Chrome-heavy estates, only the Android slice is affected, and impact is primarily per-device rather than a central service compromise.
• No public exploitation signal: no KEV entry, no public PoC found, and a near-zero EPSS all argue against urgent weaponization pressure.
• Sandboxing matters: arbitrary code execution in Chrome is serious, but on Android it does not automatically equal full device compromise without a second-stage escape or abuse path.

Why not higher?

A higher rating would fit a remotely reachable browser RCE with a public PoC or active exploitation, especially one triggered by a malicious page with no local foothold requirement. That is not what this record says: it explicitly requires a local attacker and a malicious file, and the remaining details are still restricted.

Why not lower?

It should not be pushed to LOW because it is still a memory-corruption code-execution bug in a massively deployed browser component. If an attacker already has local presence on a managed Android device, this can become a useful privilege-expanding pivot inside a real intrusion chain.

1. Inventory Android Chrome versions — Pull device/app version data from MDM, EMM, or managed Google Play and isolate any device below 149.0.7827.53. For a MEDIUM verdict there is no mitigation SLA, so use this as normal remediation planning and complete patch validation within the 365-day remediation window.
2. Lock down sideloading and USB debugging — Reduce the easiest local-attack paths by disabling unknown sources, restricting adb/USB debugging, and enforcing app install policy on corporate Android devices. This is the highest-value friction point because the exploit starts with local file placement; keep the policy in force while devices move through the 365-day remediation window.
3. Prefer managed Play auto-update enforcement — Ensure Chrome auto-updates are not deferred for Android work devices and that update rings are not pinning vulnerable builds. For MEDIUM, there is no separate mitigation deadline, so this is a straightforward patch hygiene action to keep remediation inside the 365-day window.
4. Watch for suspicious local-file abuse in Chrome — If you run mobile threat defense or Android telemetry, alert on unusual Chrome launches from downloads, file managers, or untrusted apps. This will not prevent exploitation by itself, but it can surface the prerequisite local-delivery stage during the 365-day remediation period.

Run this from an auditor workstation with Android Platform Tools (adb) installed, not on the device itself. Invoke it as ./check_cve_2026_10923.sh SERIAL1234 or ANDROID_SERIAL=SERIAL1234 ./check_cve_2026_10923.sh; it needs adb access to the target device but does not require root.

#!/usr/bin/env bash
# check_cve_2026_10923.sh
# Verify whether Google Chrome on an Android device is vulnerable to CVE-2026-10923
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

PKG="com.android.chrome"
FIXED_VERSION="149.0.7827.53"
SERIAL="${1:-${ANDROID_SERIAL:-}}"

adb_cmd=(adb)
if [[ -n "$SERIAL" ]]; then
  adb_cmd+=( -s "$SERIAL" )
fi

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

version_ge() {
  # returns 0 if $1 >= $2
  local a b i
  IFS='.' read -r -a a <<< "$1"
  IFS='.' read -r -a b <<< "$2"
  for ((i=${#a[@]}; i<4; i++)); do a[i]=0; done
  for ((i=${#b[@]}; i<4; i++)); do b[i]=0; done
  for i in 0 1 2 3; do
    local ai="${a[i]:-0}"
    local bi="${b[i]:-0}"
    if ((10#$ai > 10#$bi)); then
      return 0
    elif ((10#$ai < 10#$bi)); then
      return 1
    fi
  done
  return 0
}

command -v adb >/dev/null 2>&1 || fail_unknown "adb not found in PATH"

state="$(${adb_cmd[@]} get-state 2>/dev/null || true)"
[[ "$state" == "device" ]] || fail_unknown "no reachable adb device"

pkg_info="$(${adb_cmd[@]} shell dumpsys package "$PKG" 2>/dev/null || true)"
[[ -n "$pkg_info" ]] || fail_unknown "package $PKG not found or inaccessible"

version_name="$(printf '%s\n' "$pkg_info" | sed -n 's/.*versionName=\([^[:space:]]*\).*/\1/p' | head -n1)"
if [[ -z "$version_name" ]]; then
  version_name="$(${adb_cmd[@]} shell cmd package list packages --show-versioncode "$PKG" 2>/dev/null | sed -n 's/.*versionName=\([^[:space:]]*\).*/\1/p' | head -n1 || true)"
fi

[[ -n "$version_name" ]] || fail_unknown "could not determine Chrome version"

# Normalize potential suffixes (e.g. 149.0.7827.53-beta -> 149.0.7827.53)
normalized="$(printf '%s' "$version_name" | sed 's/[^0-9.].*$//')"
[[ -n "$normalized" ]] || fail_unknown "unable to normalize version string: $version_name"

if version_ge "$normalized" "$FIXED_VERSION"; then
  echo "PATCHED: $PKG version $version_name on device meets or exceeds fixed version $FIXED_VERSION"
  exit 0
else
  echo "VULNERABLE: $PKG version $version_name on device is below fixed version $FIXED_VERSION"
  exit 1
fi

Sources

1. Official CVE JSON record for CVE-2026-10923
2. Chrome Releases: Stable Channel Update for Desktop (Chrome 149 security fixes)
3. Chrome Releases: Chrome for Android Update (Android releases inherit corresponding desktop fixes unless noted)
4. Chromium security severity guidelines
5. Chromium memory safety overview
6. Chromium Site Isolation overview
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS documentation and API reference