CVE-2026-10967: Chrome Android SurfaceCapture Use-After-Free Sandbox Escape

Technical summary

CVE-2026-10967 is a use-after-free vulnerability (CWE-416) in the SurfaceCapture component of Chromium's Android implementation. The flaw allows a malicious renderer process to access freed memory through a crafted HTML page, potentially enabling a sandbox escape. The vulnerability sits at the intersection of renderer compromise and memory safety; an attacker must first corrupt or control the renderer context, then leverage the use-after-free to execute arbitrary code with elevated privileges outside the sandbox boundary.

Business impact

A successful exploit could give attackers direct access to Android device resources, including sensitive user data, communications, and system files. For organizations with BYOD policies or employees using Chrome on personal Android devices for work, this represents a pathway to device compromise and lateral movement into corporate networks. The requirement for renderer compromise adds a practical hurdle, but combined with a prior browser vulnerability or social engineering, this becomes a credible multi-stage attack vector.

Affected systems

Google Chrome on Android devices running versions prior to 149.0.7827.53 are affected. Desktop Chrome versions are not impacted by this specific flaw. The vulnerability is specific to the Android implementation of the SurfaceCapture API and does not affect Chrome on iOS, Windows, macOS, or Linux.

Exploitability

The attack has moderate practical exploitability despite its high severity. An attacker must first achieve renderer process compromise—a non-trivial prerequisite typically requiring a separate vulnerability or sophisticated social engineering. However, once renderer control is established, triggering the use-after-free via crafted HTML is relatively straightforward. User interaction (visiting a webpage) is required, making targeted phishing a likely delivery mechanism. The CVSS score of 8.3 reflects the high impact conditional on these preconditions being met.

Remediation

Update Chrome on Android to version 149.0.7827.53 or later. Google has patched the underlying memory safety issue in the SurfaceCapture component. Organizations should prioritize deployment of this update, especially for devices used in sensitive roles or with access to corporate resources.

Patch guidance

Verify the installed Chrome version on Android devices by opening Chrome, navigating to Settings > About Chrome, and confirming the version number is 149.0.7827.53 or higher. Chrome typically auto-updates, but forced updates can be triggered via Google Play Store or organization-wide mobile device management (MDM) policies. For enterprise deployments, push the patched version through your MDM solution and monitor compliance rates. Test the update in a limited environment first if you maintain custom Chrome deployments.

Detection guidance

Detection of active exploitation is challenging without privileged access to the device. Focus on prevention: ensure Chrome auto-updates are enabled and monitor for suspicious app behavior post-update (unusual process spawning, file access, or network connections). Security information and event management (SIEM) systems may detect lateral movement attempts originating from compromised Android devices if network telemetry is available. Intrusion detection systems should look for abnormal Chrome renderer process behavior or attempts to access restricted system APIs following a targeted phishing campaign.

Why prioritize this

Despite not appearing on the KEV catalog, this vulnerability merits high priority due to its severity rating, the expanding attack surface of Android in enterprise environments, and the clarity of the technical exploit path once renderer compromise is achieved. Organizations with Android device populations in sensitive roles should patch immediately. The combination of high impact (C:H, I:H, A:H), remote attack vector, and relative ease of exploitation post-compromise warrants urgent attention in patch management queues.

Risk score, explained

The CVSS 3.1 score of 8.3 reflects a network-accessible, high-impact vulnerability with a high attack complexity (renderer compromise required) and mandatory user interaction (visiting a malicious page). The score escalates from potential but non-immediate exploitability to high urgency due to the scope change (C:S)—a sandbox escape that extends impact beyond the Chrome process itself to the broader Android system and user data.

Frequently asked questions