CVE-2026-12438: Critical Chrome WebView Sandbox Escape on Android

Technical summary

CVE-2026-12438 is a sandbox escape vulnerability in Chrome's WebView component on Android, stemming from inappropriate implementation in the HTML rendering stack. The vulnerability requires two conditions: first, an attacker must already have compromised the renderer process (which runs in a sandboxed context), and second, the victim must interact with a crafted HTML page. Once triggered, the flaw permits an attacker to escape the sandbox boundary and execute code with elevated privileges outside the restricted rendering environment. The issue is classified as CWE-693 (Improper Protection of Structural Elements) and carries a CVSS 3.1 score of 8.3 (HIGH), with high confidentiality, integrity, and availability impact across system boundaries.

Business impact

A successful exploit could result in unauthorized access to sensitive data stored on the device, modification of system settings or user data, denial of service, and potential lateral movement to other applications or services on the Android device. Organizations deploying Chrome on Android devices for work purposes face risk of data exfiltration and credential theft. The multi-stage nature of the attack (renderer compromise required) somewhat limits the immediate blast radius, but the severity is high because once the first stage is achieved, the sandbox escape could be near-automatic. Device users may not realize their system has been compromised until malicious activity is detected.

Affected systems

Google Chrome on Android devices running versions prior to 149.0.7827.155 are affected. This includes all Android variants where Chrome is the primary or supplemental browser. The vulnerability does not affect Chrome on desktop platforms (Windows, macOS, Linux) or other mobile platforms where WebView may be used. Any device unable to update to version 149.0.7827.155 or later remains vulnerable.

Exploitability

Exploitation requires two sequential compromises: the attacker must first establish control of the Chrome renderer process, and then serve a specially crafted HTML page to trigger the sandbox escape. The renderer compromise could occur through other vulnerabilities, malicious ads, or compromised websites. The attack vector is network-based, but user interaction is required (the victim must visit or interact with the malicious page). The access control requirement (prior renderer compromise) elevates the bar for exploitation, which is reflected in the CVSS 'High' attack complexity rating. However, Chrome users visit thousands of untrusted websites daily, making the second stage plausible once the first stage is achieved. The vulnerability is not yet listed in CISA's Known Exploited Vulnerabilities catalog as of the available data.

Remediation

Users must update Chrome on Android to version 149.0.7827.155 or later. Organizations should enforce automatic updates or push the latest version through mobile device management (MDM) solutions. Until patched, users should avoid untrusted websites, disable JavaScript if possible (though this severely impacts functionality), and monitor devices for signs of compromise. Enterprise deployments should verify that all Android devices in their fleet are running compliant Chrome versions.

Patch guidance

Google has released Chrome 149.0.7827.155 and later for Android to address this vulnerability. Verify patch deployment through the Google Play Store or enterprise distribution channels. Users with automatic updates enabled should receive the patch automatically; however, organizations should confirm deployment rather than assuming it has occurred. Check Chrome's About menu (Settings > About Chrome) to verify the installed version. For managed devices, use MDM console reporting to audit version compliance across your fleet. Rollout should be prioritized given the Critical severity designation and the potential for device-level compromise.

Detection guidance

Monitor for unusual Chrome renderer process behavior, including unexpected crashes, memory access violations, or attempts to load suspicious native code libraries. Endpoint detection and response (EDR) tools with Android support should flag suspicious WebView process escalations or capability acquisitions. Network-based detection is difficult because the HTML payload itself may not be distinctive; focus on behavioral signals post-exploitation, such as processes accessing sensitive device APIs they should not, unauthorized file access, or credential harvesting attempts. Collect Chrome crash reports and look for segmentation faults or privilege-escalation-related exceptions. Device behavior monitoring for unauthorized system call patterns may catch exploitation attempts.

Why prioritize this

This vulnerability merits immediate priority for several reasons: (1) Chromium itself has designated it as Critical severity; (2) a successful exploit results in sandbox escape with full system access potential; (3) Android is a primary attack surface for consumers and enterprises alike; (4) the attack relies on a two-stage model, but the second stage is highly plausible given user browsing habits; (5) no known public exploits are currently tracked, providing a window for patching before weaponization. Organizations should treat this as a must-patch within 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH) reflects the combination of network attack vector, moderate attack complexity (due to renderer compromise prerequisite), no privilege requirement, user interaction requirement, and high impact across confidentiality, integrity, and availability with scope change. While the score is HIGH rather than CRITICAL, the real-world severity is elevated by the fact that this is a sandbox escape—a capability that transforms limited process-level compromise into device-level compromise. The lack of public exploits and the two-stage requirement provide a brief respite, but the underlying risk is substantial.

Frequently asked questions