Use after free in Messages in Google Chrome on Android prior to 149

CVE-2026-11163 is a use-after-free (CWE-416) in the Messages component of Google Chrome on Android. Per the supplied intel, it affects Chrome on Android before 149.0.7827.53 and can let a remote attacker *potentially* achieve a sandbox escape after getting the victim to interact with attacker-controlled content. Google’s Android release train shipped Chrome 149.0.7827.59 on June 2, 2026, and Google states Android carries the same security fixes as the corresponding desktop release.

paragraph 2: The user-supplied CRITICAL 9.6 label overstates the operational risk for enterprise patch triage. The downward pressure is real: Android-only, user interaction required, no KEV, no public exploitation evidence found in reviewed primary sources, EPSS is extremely low, and Google’s own Chrome release notes classify this specific CVE as Medium internal severity. That said, it still lands in HIGH because it is a remotely reachable browser memory-corruption bug with *potential sandbox escape* impact in a massively deployed client application.

Why this verdict

• Baseline correction: the supplied vendor/CNA score is 9.6 CRITICAL, but Google’s own Chrome release notes classify this specific CVE as Medium internal severity, so the raw CVSS headline is already suspect as a prioritization anchor.
• Attacker path requires UI: this is remote and unauthenticated, but it still needs user interaction. That drops it below wormable or silent-drive-by-zero-click cases.
• Platform friction matters: the bug is Android-only, which cuts reachable enterprise population versus 'all Chrome everywhere'. If only a fraction of your 10,000 endpoints are Android handsets using Chrome, your exposed blast radius is narrower from the start.
• No exploitation signal: not in KEV, no public exploitation evidence found, and EPSS is 0.00068. That is strong downward pressure relative to a true emergency browser zero-day.
• Still not benign: browser memory corruption with potential sandbox escape is not backlog fodder. If hit, the attacker is starting from an internet-reachable client app with high user density.

Why not higher?

I am not calling this CRITICAL because the chain is narrower than the score suggests: Android-only, UI:R, no verified in-the-wild use, and no public exploit kit. On top of that, Google’s own release notes mark the issue Medium, which is a meaningful counterweight against the supplied 9.6 headline.

Why not lower?

I am not pushing this down to MEDIUM because the attacker does not need credentials, local access, or prior foothold. A remotely triggerable browser UAF with *potential sandbox escape* in a ubiquitous client app is still the kind of bug that deserves deliberate fleet attention, even without exploitation evidence.

1. Force Chrome updates through EMM/managed Google Play — Push or enforce Chrome for Android 149.0.7827.59+ through managed Google Play and verify rollout in device inventory. For a HIGH verdict, deploy this compensating step within 30 days if you cannot prove immediate patch coverage.
2. Quarantine stale mobile browsers from sensitive workflows — Use conditional access, app protection, or compliance policy to restrict devices still running vulnerable Chrome builds from accessing higher-risk SaaS or internal portals. If patch lag exists, apply this containment within 30 days.
3. Measure exposure from device inventory, not network scanners — Build a report keyed on the installed package com.android.chrome and version number from MDM/EMM or ADB-based spot checks. For this HIGH verdict, complete initial exposure measurement and exception identification within 30 days.
4. Prefer work-profile containment on unmanaged-risk handsets — If you cannot immediately verify Chrome version on BYOD or lightly managed Android devices, move corporate access into a managed work profile or equivalent isolation boundary. Use that as an interim risk reducer within 30 days.

Run this from an auditor workstation with ADB installed and USB debugging or approved ADB-over-network access to the target Android device. Invoke it as ./check_chrome_android_cve_2026_11163.sh <adb-serial> or ./check_chrome_android_cve_2026_11163.sh for the only attached device; no root is required, but ADB access is.

#!/usr/bin/env bash
# check_chrome_android_cve_2026_11163.sh
# Checks whether Google Chrome on an Android device is vulnerable to CVE-2026-11163
# Vulnerable if com.android.chrome version is lower than 149.0.7827.53
# Practical fixed Android release observed by Google: 149.0.7827.59
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

PKG="com.android.chrome"
MIN_FIXED="149.0.7827.53"
SERIAL_ARG="${1:-}"
ADB_BIN="adb"

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

if ! command -v "$ADB_BIN" >/dev/null 2>&1; then
  fail_unknown "adb not found in PATH"
fi

ADB=("$ADB_BIN")
if [ -n "$SERIAL_ARG" ]; then
  ADB+=( -s "$SERIAL_ARG" )
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  fail_unknown "no reachable adb device${SERIAL_ARG:+ for serial $SERIAL_ARG}"
fi

# Confirm package exists
if ! "${ADB[@]}" shell pm path "$PKG" >/dev/null 2>&1; then
  fail_unknown "$PKG not installed or inaccessible"
fi

VERSION_RAW=$("${ADB[@]}" shell dumpsys package "$PKG" 2>/dev/null | tr -d '\r' | awk -F= '/versionName=/{print $2; exit}')

if [ -z "$VERSION_RAW" ]; then
  VERSION_RAW=$("${ADB[@]}" shell cmd package dump "$PKG" 2>/dev/null | tr -d '\r' | awk -F= '/versionName=/{print $2; exit}')
fi

VERSION=$(echo "$VERSION_RAW" | tr -d '[:space:]')

if [ -z "$VERSION" ]; then
  fail_unknown "could not determine Chrome versionName"
fi

ver_ge() {
  # returns 0 if $1 >= $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" = "$1" ]
}

if ver_ge "$VERSION" "$MIN_FIXED"; then
  echo "PATCHED: $PKG version $VERSION >= $MIN_FIXED"
  exit 0
else
  echo "VULNERABLE: $PKG version $VERSION < $MIN_FIXED"
  exit 1
fi

Sources

1. Google Chrome for Android update (Chrome 149.0.7827.59)
2. Google Stable Channel Update for Desktop (Chrome 149 security fixes list)
3. Chrome Releases June 2026 archive
4. Chromium Security overview
5. Google Chrome on Google Play
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data and statistics
8. FIRST EPSS API documentation