CVE-2026-12442: Android Chrome Use-After-Free Code Execution Vulnerability

Technical summary

CVE-2026-12442 is a use-after-free vulnerability (CWE-416) in the password management component of Google Chrome on Android. The flaw exists in versions prior to 149.0.7827.155 and stems from improper memory lifecycle management. When a crafted HTML page is loaded, the attacker can trigger a code path that accesses memory that has already been freed, allowing them to overwrite or inject executable code. The attack surface is the web browser itself, making this exploitable through any HTTPS or HTTP navigation. Chromium rates this Critical; CVSS 3.1 assessment yields 8.8 (HIGH), reflecting high confidentiality, integrity, and availability impact with no special privileges or configuration required.

Business impact

This vulnerability puts Android users of Chrome at direct risk of account compromise, data exfiltration, and device takeover. For enterprises, the concern is heightened if employees use Chrome on personal Android devices for work email, document access, or privileged applications. An attacker who gains code execution can steal stored passwords, session tokens, and cached credentials, then pivot to corporate systems. For consumer users, password theft and identity fraud are primary threats. The need for user interaction (visiting a malicious page) slightly limits opportunistic mass exploitation, but targeted phishing campaigns are practical.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.155 are vulnerable. Desktop and iOS Chrome are not affected by this specific flaw; this is Android-only. Any Android device running an older version of Chrome is at risk. Organizations using mobile device management (MDM) should verify installed Chrome versions across their Android fleet.

Exploitability

Exploitability requires user interaction: the victim must visit or be redirected to a crafted HTML page. This is not a zero-click attack. However, the barrier is low—social engineering, phishing links, or advertising networks can deliver the payload. Once the page loads, code execution is reliable in vulnerable versions. No additional user action (such as form submission or permission grant) is needed beyond page load. The attack vector is network-based and does not require authentication or special privileges. Public exploit code is not yet known to be widely circulated, but the simplicity of the vulnerability suggests proof-of-concept development is likely.

Remediation

Immediate action: update Google Chrome on Android to version 149.0.7827.155 or later. Android users should enable automatic app updates in Google Play to ensure Chrome stays current. Enterprise administrators should use MDM policies to enforce Chrome version minimums and auto-update schedules. No workarounds exist; patching is the only mitigation. Users unable to patch immediately should minimize Chrome usage on sensitive tasks and avoid clicking untrusted links.

Patch guidance

Update to Chrome 149.0.7827.155 or later on Android. In Google Play, open Chrome, tap the profile icon, select 'About Chrome,' and the app will automatically check for and install updates if available. Administrators managing Android devices via MDM can push this version or set policies requiring auto-update. Verify the version string in Chrome Settings > About Chrome post-update. No interim versions or partial patches exist; only the stated version or newer resolves the issue.

Detection guidance

Monitor Chrome version numbers across Android devices using MDM telemetry or inventory tools. Flag any device running a version below 149.0.7827.155. Network detection is limited since the attack uses normal HTTPS traffic; however, intrusion detection systems (IDS) may flag unusual post-exploitation activity such as outbound connections from Chrome processes to suspicious C2 servers. Behavioral signals include rapid credential access attempts, unexpected data exfiltration, or new administrative accounts created post-compromise. Endpoint detection and response (EDR) solutions with Android support should monitor for code execution in Chrome sandbox escape scenarios.

Why prioritize this

This vulnerability merits urgent attention despite not yet appearing on the CISA KEV list. The combination of remote network exploitability, high impact (code execution with full device access), and low-to-moderate exploitation barrier (user click) makes it a priority target for both criminal and nation-state actors. Android adoption is massive; any widely used application vulnerability affecting hundreds of millions of devices justifies rapid patching. The password system exposure is particularly sensitive for credential theft campaigns. Organizations should prioritize patching ahead of the typical monthly maintenance window.

Risk score, explained

CVSS 3.1 score of 8.8 reflects the severity: attack vector network (no special access), low attack complexity (no special conditions), no privileges required, user interaction required (moderate mitigation), scope unchanged, and high impact on confidentiality, integrity, and availability. The score sits at the boundary between HIGH and CRITICAL; Chromium's own Critical rating acknowledges the practical threat level despite the user interaction requirement. In a security landscape where targeted phishing is common, the UI requirement does not meaningfully reduce risk for motivated attackers.

Frequently asked questions