Use after free in Input in Google Chrome on Android prior to 149

CVE-2026-10959 is a use-after-free in Chrome's Input component that lets a malicious web page trigger arbitrary code execution inside Chrome's sandbox on Android. The public records describe affected builds as Google Chrome on Android prior to 149.0.7827.53; Google then shipped Chrome for Android 149.0.7827.59 on June 2, 2026, and explicitly states Android carries the same security fixes as the corresponding desktop 149.0.7827.53/54 release.

The vendor's HIGH 8.8 baseline is technically defensible in CVSS terms, but it overstates enterprise patch urgency for standalone prioritization. The decisive reality is that this is sandboxed renderer code execution with required user interaction, no public exploit chain, no KEV entry, and a microscopic EPSS signal; on its own, it is usually a single-app compromise primitive, not full device takeover.

Why this verdict

• Downgraded for sandbox-only impact: the advertised outcome is arbitrary code execution inside a sandbox, not a full Android compromise primitive.
• Downgraded for user-interaction requirement: the attacker needs the victim to open crafted web content, which implies phishing, malvertising, or site compromise rather than direct remote reachability.
• Downgraded for weak threat telemetry: no KEV listing, no public exploitation evidence, and EPSS 0.0008 all argue against emergency fleet disruption.
• Still not LOW: Chrome is ubiquitous, the attack is remote, and browser-memory-corruption bugs are valuable chain components when paired with a sandbox escape or session objective.

Why not higher?

It is not higher because this CVE does not deliver full device compromise by itself; the documented impact stops at renderer-level execution within Chrome's sandbox. There is also no public evidence here of active exploitation, KEV inclusion, or a broadly available exploit chain that would justify treating it like an urgent outbreak-grade browser zero-day.

Why not lower?

It is not lower because remote browser memory corruption on a massively deployed client remains a meaningful enterprise risk class. If a user on an affected Android device hits the wrong page, the attacker can still gain execution inside the browser process, which is more than mere nuisance or backlog hygiene.

1. Force Chrome auto-update on Android — Use MDM/EMM policy to verify managed Android devices move to 149.0.7827.59+ and stop lagging on pre-fix builds. For a MEDIUM verdict there is no mitigation SLA; use normal operations and complete patch remediation within the 365-day window, but most fleets should finish far sooner because this is a core browser.
2. Reduce risky web delivery paths — Apply or tighten secure web gateway, mobile threat defense, DNS filtering, and phishing-resistant link protection for Android users so fewer malicious pages ever render in Chrome. There is no mitigation SLA — go straight to the 365-day remediation window, but these controls are useful immediately if patch rollout is uneven.
3. Inventory browser versions from MDM — Pull package-version inventory for com.android.chrome and target only devices below the fixed train to avoid blind spots. For this MEDIUM finding, keep it in your normal remediation queue and close version drift within the 365-day remediation deadline.
4. Harden web-to-SSO paths — Because renderer compromise often aims at session theft rather than OS takeover, prioritize stronger session protections around enterprise apps accessed from mobile browsers, including re-authentication for sensitive actions and shorter token lifetimes where feasible. This is compensating hardening, not a substitute for the browser update, and there is no mitigation SLA attached to it.

Run this on an auditor workstation with adb installed, not on the Android device itself. Invoke it as ./check-cve-2026-10959.sh <device-serial> or ./check-cve-2026-10959.sh for a single connected device; no root is required, but the device must allow ADB and expose package info for com.android.chrome.

#!/usr/bin/env bash
# check-cve-2026-10959.sh
# Determine whether an Android device's Google Chrome version is vulnerable to CVE-2026-10959.
# Vulnerable: Chrome on Android versions prior to 149.0.7827.53
# Practical patched train from Google Android release: 149.0.7827.59+
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/adb error

set -u

TARGET_VERSION="149.0.7827.53"
PACKAGE="com.android.chrome"
SERIAL="${1:-}"

adb_cmd() {
  if [[ -n "$SERIAL" ]]; then
    adb -s "$SERIAL" "$@"
  else
    adb "$@"
  fi
}

version_lt() {
  # returns 0 if $1 < $2
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  [[ ${#b[@]} -gt $len ]] && len=${#b[@]}
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai < 10#$bi)); then
      return 0
    elif ((10#$ai > 10#$bi)); then
      return 1
    fi
  done
  return 1
}

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN: adb not found in PATH"
  exit 3
fi

STATE="$(adb_cmd get-state 2>/dev/null)"
if [[ "$STATE" != "device" ]]; then
  echo "UNKNOWN: no connected/authorized Android device${SERIAL:+ for serial $SERIAL}"
  exit 2
fi

PKG_DUMP="$(adb_cmd shell dumpsys package "$PACKAGE" 2>/dev/null | tr -d '\r')"
if [[ -z "$PKG_DUMP" ]]; then
  echo "UNKNOWN: unable to query package $PACKAGE"
  exit 2
fi

VERSION_NAME="$(printf '%s\n' "$PKG_DUMP" | sed -n 's/.*versionName=\([^ ]*\).*/\1/p' | head -n1)"
if [[ -z "$VERSION_NAME" ]]; then
  VERSION_NAME="$(adb_cmd shell cmd package dump "$PACKAGE" 2>/dev/null | tr -d '\r' | sed -n 's/.*versionName=\([^ ]*\).*/\1/p' | head -n1)"
fi

if [[ -z "$VERSION_NAME" ]]; then
  echo "UNKNOWN: Chrome installed state/version could not be determined"
  exit 2
fi

if version_lt "$VERSION_NAME" "$TARGET_VERSION"; then
  echo "VULNERABLE: $PACKAGE version $VERSION_NAME is older than $TARGET_VERSION"
  exit 1
else
  echo "PATCHED: $PACKAGE version $VERSION_NAME is at or above $TARGET_VERSION"
  exit 0
fi

Sources

1. GitHub Advisory Database GHSA-r535-vj4v-w8rf
2. NVD CVE-2026-10959
3. Chrome Releases: Stable Channel Update for Desktop (June 2026)
4. Chrome Releases: Chrome for Android Update (June 2, 2026)
5. Chrome Releases: Chrome for Android Early Stable Update (May 28, 2026)
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS documentation
8. FIRST API v1 EPSS endpoint documentation