Use after free in WebView in Google Chrome on Android prior to 149

CVE-2026-11072 is a use-after-free in Android WebView/Chrome WebView code affecting Google Chrome on Android before 149.0.7827.53. In plain terms, malformed content can make WebView reference memory after it has been released, which can crash the component or, in the worst case, turn memory corruption into attacker-controlled code execution. The affected population is Android devices using vulnerable Chrome/WebView builds, not Windows, macOS, Linux, or server-side Chrome consumers.

Google's HIGH / 7.8 score is technically defensible in a vacuum because memory-corruption plus arbitrary code execution is never trivial. But for enterprise patch prioritization, that label overstates the fleet-wide urgency: the attacker needs a local position on the device and user interaction, there is no KEV listing, the supplied EPSS is extremely low, and the blast radius is constrained to the subset of your managed Android/WebView estate rather than your core desktop or internet-facing fleet.

Why this verdict

• Start at vendor 7.8/HIGH because memory corruption with possible arbitrary code execution in a widely deployed engine is never harmless
• Downshift for attacker position: AV:L means the attacker already needs a foothold on the Android device, which implies a prior compromise stage or local app placement
• Downshift for interaction and population: UI:R plus Android-only WebView scope narrows the reachable population far below a remotely reachable desktop Chrome bug
• Downshift for threat evidence: no KEV listing, no public exploit found in review, and the supplied EPSS 0.00009 all point to weak real-world exploitation pressure

Why not higher?

This is not an internet-edge issue and not even a standard remote client bug. To matter, the attacker must already be on the handset or get a malicious app onto it, then still rely on a WebView interaction path and exploit stability on modern Android builds.

Why not lower?

It is still arbitrary code execution from a memory-corruption flaw in a ubiquitous mobile rendering component. If you do operate a large managed Android estate with permissive app installation or risky in-app WebView usage, it deserves patching and version hygiene rather than dismissal.

1. Block sideloading where possible — Use MDM/EMM policy to restrict unknown sources, third-party app stores, and unmanaged app install paths. For a LOW verdict there is no mitigation SLA, so treat this as backlog hygiene and apply it in your normal mobile-hardening cycle; it directly attacks the biggest prerequisite in this chain: local foothold.
2. Enforce managed app allowlists — Keep only approved business apps on corporate Android devices and require Play Protect or equivalent mobile threat defense. For this verdict there is no mitigation SLA, so fold it into routine mobile compliance enforcement and use it to reduce the chance an attacker can plant the malicious local app needed to reach the bug.
3. Inventory actual WebView provider versions — Do not rely on Android OS version alone; identify whether the active WebView provider is Chrome or Android System WebView and collect the exact installed version. There is no mitigation SLA here, but this check should be part of your next mobile exposure review because vulnerable and patched states can diverge across OEMs.
4. Prefer external browser over embedded WebView for risky flows — For enterprise apps under your control, move high-risk auth and untrusted web content out of embedded WebView and into the platform browser where feasible. There is no mitigation SLA for LOW, so handle this as application hardening work, not emergency response.

Run this from an auditor workstation with adb installed against a USB-connected or enterprise-debuggable Android device. Invoke it as ./check_cve_2026_11072.sh <device-serial> or ./check_cve_2026_11072.sh for the only attached device; it needs adb access, but not root.

#!/usr/bin/env bash
# check_cve_2026_11072.sh
# Verify whether an Android device is vulnerable to CVE-2026-11072 by checking
# the active WebView provider and common Chrome/WebView package versions.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / usage / adb failure

set -euo pipefail

FIXED_VERSION="149.0.7827.53"
SERIAL="${1:-}"
ADB=(adb)
if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

version_ge() {
  # returns 0 if $1 >= $2
  local a="$1" b="$2"
  if [[ "$a" == "$b" ]]; then
    return 0
  fi
  local first
  first=$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)
  [[ "$first" == "$b" ]]
}

get_pkg_ver() {
  local pkg="$1"
  "${ADB[@]}" shell dumpsys package "$pkg" 2>/dev/null | awk -F= '/versionName=/{print $2; exit}' | tr -d '\r'
}

if ! have_cmd adb; then
  fail_unknown "adb is not installed"
fi

STATE=$("${ADB[@]}" get-state 2>/dev/null || true)
if [[ "$STATE" != "device" ]]; then
  fail_unknown "no reachable adb device"
fi

# Try to identify the active WebView provider.
CURRENT_PROVIDER=$("${ADB[@]}" shell cmd webviewupdate getCurrentWebViewPackage 2>/dev/null | tr -d '\r' || true)
CURRENT_PROVIDER_PKG=$(printf '%s' "$CURRENT_PROVIDER" | sed -n 's/^[[:space:]]*Current WebView package (name, version):[[:space:]]*\([^[:space:]]*\).*/\1/p')
CURRENT_PROVIDER_VER=$(printf '%s' "$CURRENT_PROVIDER" | sed -n 's/^[[:space:]]*Current WebView package (name, version):[[:space:]]*[^[:space:]]*[[:space:]]\([^[:space:]]*\).*/\1/p')

# Fallback package checks.
CHROME_VER=$(get_pkg_ver com.android.chrome || true)
GOOGLE_WEBVIEW_VER=$(get_pkg_ver com.google.android.webview || true)
AOSP_WEBVIEW_VER=$(get_pkg_ver com.android.webview || true)

BEST_NAME=""
BEST_VER=""

if [[ -n "$CURRENT_PROVIDER_PKG" && -n "$CURRENT_PROVIDER_VER" ]]; then
  BEST_NAME="$CURRENT_PROVIDER_PKG"
  BEST_VER="$CURRENT_PROVIDER_VER"
fi

for candidate in \
  "com.android.chrome:$CHROME_VER" \
  "com.google.android.webview:$GOOGLE_WEBVIEW_VER" \
  "com.android.webview:$AOSP_WEBVIEW_VER"
 do
  NAME="${candidate%%:*}"
  VER="${candidate#*:}"
  [[ -z "$VER" ]] && continue
  if [[ -z "$BEST_VER" ]] || version_ge "$VER" "$BEST_VER"; then
    BEST_NAME="$NAME"
    BEST_VER="$VER"
  fi
 done

if [[ -z "$BEST_VER" ]]; then
  fail_unknown "could not determine Chrome/WebView package version"
fi

echo "Detected provider/package: ${BEST_NAME:-unknown}"
echo "Detected version: $BEST_VER"
echo "Fixed version threshold: $FIXED_VERSION"

if version_ge "$BEST_VER" "$FIXED_VERSION"; then
  echo "PATCHED"
  exit 0
else
  echo "VULNERABLE"
  exit 1
fi

Sources

1. Chrome Releases: Chrome for Android Update
2. Chrome Releases: Early Stable Update for Desktop
3. Chrome 149 release notes
4. Android Developers: WebView API reference
5. Android Developers: Security checklist
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS API documentation
8. GovCERT.HK alert on Chrome 149 vulnerabilities