Use after free in WebShare in Google Chrome on Android prior to 149

CVE-2026-11010 is a CWE-416 use-after-free in the Android WebShare path of Google Chrome. It affects Chrome on Android versions prior to 149.0.7827.53, and the bug sits in the browser-side share plumbing rather than being a standalone renderer RCE. In practical terms, a malicious site would first need to gain code execution in the renderer process and then steer Chrome's Android sharing flow into the vulnerable path to try for a sandbox escape.

Google's own Chromium security labeling calls this one Medium, and that is about right in enterprise reality even without an official CVSS. The decisive downgrade pressure is the prerequisite chain: renderer compromise first, Android only, and likely user-driven Web Share invocation. That makes this valuable to exploit developers building chains, but a poor candidate for mass one-click enterprise compromise by itself.

Why this verdict

• Requires a first bug: the attacker must already control a compromised renderer, which implies prior successful exploitation and sharply narrows real-world reach.
• Android-only and feature-bound: only Chrome on Android is affected, and the vulnerable path sits behind WebShare, not a ubiquitous always-on parser surface.
• Reliability looks non-trivial: the patch fixes threading/race/lifecycle issues, which usually means harder cross-device weaponization and lower mass-exploitation odds than a straightforward memory corruption primitive.

Why not higher?

This is not a one-CVE drive-by compromise. There is no published CVSS, no KEV entry, no public exploitation evidence, and the attack chain starts from an already-compromised renderer instead of an unauthenticated remote entry point. Those are strong downward pressures in enterprise prioritization.

Why not lower?

Sandbox escapes still matter because they are what turns renderer footholds into meaningful browser-context control. Chrome on Android is widespread, and if an attacker already has stage one, this bug could materially improve post-exploitation outcomes. That keeps it above LOW.

1. Force Chrome auto-update on managed Android — Use MDM/EMM managed Play controls to require com.android.chrome updates and remove version drift. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but browsers are cheap to update, so collapse exposure in your next normal mobile app cycle rather than waiting for the deadline.
2. Restrict sensitive internal apps to managed browsers — If your mobile access stack supports app protection or conditional access, require managed Chrome/current version for high-value internal web apps. This does not fix the bug, but it reduces the value of a browser escape against unmanaged or stale devices; with MEDIUM severity, fold this into standard policy tuning rather than emergency change windows.
3. Watch Android Chrome crash and version telemetry — Because exploit development against racey UAFs often crashes first, sudden com.android.chrome crash spikes on Android are worth triage. Pair crash data with app-version inventory to find lingering vulnerable cohorts during the remediation window.

Run this on an auditor workstation with the Android SDK adb installed, against a USB- or network-connected Android device that has Chrome installed. Example: ./check_cve_2026_11010.sh ABC123DEF456; no root is required, but you do need adb access to the device and permission to query package metadata.

#!/usr/bin/env bash
# check_cve_2026_11010.sh
# Verify whether Google Chrome on Android is vulnerable to CVE-2026-11010
# Affected: Chrome on Android < 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

PKG="com.android.chrome"
FIXED_VERSION="149.0.7827.53"
SERIAL="${1:-}"
ADB_BIN="${ADB_BIN:-adb}"

adb_cmd() {
  if [[ -n "$SERIAL" ]]; then
    "$ADB_BIN" -s "$SERIAL" "$@"
  else
    "$ADB_BIN" "$@"
  fi
}

version_lt() {
  # returns 0 if $1 < $2
  local IFS=.
  local i
  local -a a=($1) b=($2)
  local len=${#a[@]}
  if (( ${#b[@]} > len )); then
    len=${#b[@]}
  fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai < 10#$bi)); then
      return 0
    elif ((10#$ai > 10#$bi)); then
      return 1
    fi
  done
  return 1
}

if ! command -v "$ADB_BIN" >/dev/null 2>&1; then
  echo "UNKNOWN - adb not found in PATH"
  exit 2
fi

if ! adb_cmd get-state >/dev/null 2>&1; then
  echo "UNKNOWN - no reachable adb device"
  exit 2
fi

PACKAGE_INFO="$(adb_cmd shell dumpsys package "$PKG" 2>/dev/null || true)"
if [[ -z "$PACKAGE_INFO" ]]; then
  echo "UNKNOWN - unable to query package info for $PKG"
  exit 2
fi

VERSION="$(printf '%s\n' "$PACKAGE_INFO" | sed -n 's/.*versionName=\([^[:space:]]*\).*/\1/p' | head -n1)"
if [[ -z "$VERSION" ]]; then
  VERSION="$(adb_cmd shell cmd package list packages -f "$PKG" 2>/dev/null | sed -n 's/.*versionName=\([^[:space:]]*\).*/\1/p' | head -n1)"
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - Chrome not installed or versionName unavailable"
  exit 2
fi

if version_lt "$VERSION" "$FIXED_VERSION"; then
  echo "VULNERABLE - $PKG version $VERSION is older than fixed $FIXED_VERSION"
  exit 1
else
  echo "PATCHED - $PKG version $VERSION is at or above fixed $FIXED_VERSION"
  exit 0
fi

Sources

1. Google Chrome Releases - Stable Channel Update for Desktop (June 2, 2026)
2. Google Chrome Releases - Chrome for Android Update (May 28, 2026)
3. Chromium fix commit for issue 496266444
4. Chromium Docs - Threat Model And Defenses Against Compromised Renderers
5. Chromium Docs - Chrome Android Sandbox Design
6. W3C Web Share API Recommendation
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS documentation