CVE-2026-11188: Chrome Android USB Use-After-Free Sandbox Escape Vulnerability

Technical summary

CVE-2026-11188 is a use-after-free condition (CWE-416) in the USB subsystem of Google Chrome on Android. The flaw allows a remote, unauthenticated attacker to craft malicious HTML that triggers memory corruption in the USB driver code path. When a user visits the malicious page, freed memory is accessed, corrupting process state and enabling sandbox escape. The Chromium security team rates this as Medium severity, though the CVSS 3.1 score of 8.8 reflects the high impact of successful exploitation.

Business impact

Successful exploitation leads to complete compromise of the Chrome process and potential device-level access on Android. An attacker could steal sensitive data stored in or accessible through Chrome, modify user credentials, install persistent malware, or pivot to other applications and services on the device. For organizations with Android-heavy workforces or BYOD policies, this poses a material risk to corporate data and endpoint integrity.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.53. The vulnerability is specific to the Android implementation of Chrome's USB stack and does not affect Chrome on other platforms (Windows, macOS, Linux, iOS). Severity correlates with the prevalence of Chrome on Android devices in your environment.

Exploitability

Exploitation requires user interaction—the victim must visit a malicious webpage. However, the barrier to delivery is low; the attacker needs only network access to serve the HTML, with no special privileges or complex attack infrastructure. Once the user visits the page, exploitation is reliable if the vulnerable Chrome version is running. Active exploitation in the wild is not currently documented in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. This release addresses the use-after-free condition. Users should enable automatic updates in Chrome's settings to ensure timely patching. For organizations managing Android devices, enforce Chrome version requirements through mobile device management (MDM) policies.

Patch guidance

Google released the fix in Chrome 149.0.7827.53 for Android. Verify this version number against Google's official security advisory before deployment. Users can check their installed version in Chrome Settings > About Chrome, which will also trigger an automatic update check. MDM administrators should target this minimum version in device compliance policies and validate rollout across the fleet within 30 days of patch availability.

Detection guidance

Monitor Chrome crash logs and memory violation alerts for USB-related faults on Android devices. Look for anomalous process terminations following user browsing activity. Endpoint detection and response (EDR) tools with Android capability should flag use-after-free memory patterns in Chrome processes. Web gateway logs can identify users visiting known malicious HTML pages; coordinate with threat intelligence feeds for indicators of compromise.

Why prioritize this

Although not yet in CISA's KEV catalog, the combination of sandbox escape capability, low exploitation barrier (user click required), and high confidentiality and integrity impact warrants rapid patching. Android devices are prevalent in modern workforces, and compromised browsers often serve as a foothold for lateral movement. Organizations should prioritize this alongside critical OS-level Android vulnerabilities.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability requiring only user interaction, with no authentication needed, and high impact across confidentiality, integrity, and availability. The sandbox escape elevates practical risk beyond typical web vulnerability constraints. Contextually, absence from the KEV catalog suggests limited public exploitation, but the technical severity remains substantial.

Frequently asked questions