CVE-2026-11647: Android Chrome Sandbox Escape via Use-After-Free in Printing

Technical summary

CVE-2026-11647 is a use-after-free (CWE-416) vulnerability in the printing subsystem of Google Chrome on Android versions prior to 149.0.7827.103. The flaw arises from improper memory management in the printing code path, allowing a compromised renderer process to reference freed memory and potentially execute arbitrary code with higher privileges. The attack surface is limited to authenticated scenarios where the renderer is already under attacker control, but successful exploitation enables sandbox escape—a critical capability that can lead to full device compromise.

Business impact

For Android device users, successful exploitation could result in complete device takeover, including access to sensitive data, credentials, and installed applications. For enterprises with Android fleet deployment, this represents a two-stage attack risk: the initial renderer compromise (via other vulnerabilities or social engineering) followed by sandbox escape. Organizations should prioritize patching to limit the blast radius of secondary compromises. User-facing impact is contained to those actively browsing during exploitation.

Affected systems

Google Chrome on Android versions below 149.0.7827.103 are vulnerable. Desktop Chrome and other Chromium-based browsers on Android are not mentioned in the advisory. The vulnerability does not affect Chrome on Windows, macOS, Linux, or iOS. Organizations should audit Android deployment versions and establish a baseline for patch status.

Exploitability

Exploitation requires a multi-step approach: an attacker must first compromise the Chrome renderer process through a separate vulnerability or attack vector, then serve a crafted HTML page to the victim to trigger the use-after-free condition and escape the sandbox. The CVSS score of 8.3 reflects the high impact (complete compromise) tempered by the requirement for user interaction (visiting a malicious page) and the prerequisite renderer compromise. This is not a one-click vulnerability but a sophisticated, chained attack. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely documented.

Remediation

Immediate action: update Chrome on all Android devices to version 149.0.7827.103 or later. Verify the update via Settings > About Chrome > Check for Updates. For managed deployments, push updates through your Mobile Device Management (MDM) solution with enforcement policies. No known workarounds exist; patching is the definitive remedy. Users should also be reminded to keep Android OS and all applications current to minimize the risk of renderer compromise in the first place.

Patch guidance

Chrome on Android should auto-update to version 149.0.7827.103 or later once released and available in your region. Verify successful patching by navigating to Settings > About Chrome and confirming the version number matches or exceeds 149.0.7827.103. For enterprise Android deployments, enforce update policies at the MDM level and do not allow prolonged deferral. Establish a 48-72 hour timeline for compliance across your user base. Test on a pilot group of devices first to ensure no compatibility issues with your organization's approved applications.

Detection guidance

Monitor for anomalous Chrome process behavior on Android devices, particularly unexpected elevation of privileges or access to sensitive system resources post-crash. Network-level detection is limited because the exploit is delivered via crafted HTML; focus on behavioral telemetry from endpoint detection and response (EDR) tools on Android if available. Log any Chrome crashes or abnormal terminations, as failed exploitation attempts may leave traces. Consider blocking known attacker-controlled domains at the network perimeter if threat intelligence identifies specific phishing campaigns exploiting this vulnerability.

Why prioritize this

High CVSS score (8.3) combined with potential for full device compromise makes this a near-critical patch for Android deployments. Although exploitation requires prior renderer compromise, the sandbox escape capability dramatically amplifies the impact of secondary vulnerabilities. Mobile devices frequently store sensitive corporate and personal data, making this relevant to any organization with Android users or BYOD policies. The lack of KEV listing suggests this has not reached widespread weaponization yet, providing a narrow window for proactive patching before exploitation becomes prevalent.

Risk score, explained

The CVSS 8.3 HIGH rating balances multiple factors: High confidentiality, integrity, and availability impact (complete device compromise potential) is offset by prerequisites including renderer process compromise (PR) and user interaction (UI:R). The attack vector is network-based (AV:N), scope is changed (S:C)—escaping the browser sandbox to affect system-level resources—and attack complexity is high (AC:H) due to the multi-step nature and need for precise memory conditions. The score appropriately reflects a serious but not trivial-to-exploit vulnerability requiring attacker skill and preparation.

Frequently asked questions