CVE-2026-12448: Android Chrome WebView Privilege Escalation—Patch Guidance

Technical summary

CVE-2026-12448 stems from an inappropriate implementation in WebView, Android's embedded browser component used by Chrome and third-party apps. The vulnerability allows privilege escalation through a network vector with no special privileges required. The attack surface is broad because WebView is invoked whenever a user navigates to a crafted HTML payload. The Chromium security team classified this as High severity due to the combination of easy triggering (requires only user interaction) and severe impact (confidentiality, integrity, and availability compromise). The CWE-269 classification (Improper Access Control) reflects that the root cause involves failure to properly enforce privilege boundaries within the rendering engine.

Business impact

Compromised Android devices running affected Chrome versions could have their data exfiltrated, modified, or deleted without the user's knowledge. Enterprise deployments managing Android fleets face risk to corporate data accessed through Chrome, as well as potential lateral movement if compromised devices access internal resources. User trust is also at stake; widespread exploitation could drive migration to competing browsers. For organizations running BYOD or corporate-managed Android devices, this represents a device-level compromise rather than merely an app-level breach.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.155 is the primary affected component. WebView is also embedded in other Android applications beyond Chrome, so third-party apps using outdated or unpatched WebView libraries may inherit this vulnerability. Android users and organizations deploying Chrome as a managed browser should prioritize assessment of their installed versions. iOS and desktop Chrome versions are not affected.

Exploitability

Exploitability is relatively straightforward for attackers. The attack requires no authentication, no special configuration, and only typical user action—visiting a link or opening a webpage. The low attack complexity (AC:L) means the exploit is reliable and does not depend on race conditions or user-specific configurations. However, the requirement for user interaction (UI:R) means mass automated exploitation is not feasible; attackers must use social engineering, malware distribution, or compromised advertisements to drive users to the malicious page. No public exploit code is currently tracked in CISA's KEV catalog.

Remediation

Immediately update Google Chrome on all Android devices to version 149.0.7827.155 or later. Users should enable automatic updates in the Google Play Store settings if not already active. Enterprise administrators managing Chrome through Mobile Device Management (MDM) solutions should deploy the patched version across their fleet using their existing update mechanisms. Organizations should also audit third-party apps for their WebView dependencies and update those apps when patches become available from their vendors.

Patch guidance

Update Chrome via the Google Play Store by navigating to Apps > My apps & games > Updates, or enable automatic updates for Chrome. Enterprise deployments should use their MDM console (Google Mobile Management, Intune, etc.) to push version 149.0.7827.155 or later. Verify successful deployment by checking Settings > About Chrome to confirm the running version. WebView updates are often delivered alongside Chrome updates but can also be updated independently through the Google Play System Update on devices running Android 10 and later. Test the patch in a controlled environment before broad rollout to confirm compatibility with any line-of-business apps that depend on WebView.

Detection guidance

Monitor Chrome version numbers across your Android device fleet using your MDM solution's reporting capabilities. On individual devices, check Settings > About Chrome for the current version number. Organizations can use their MDM console to query installed versions in bulk. Network-based detection of exploitation is limited since the attack uses normal HTTPS traffic to deliver the malicious HTML payload; focus on endpoint telemetry for unusual privilege escalation events, unexpected access to sensitive data directories, or suspicious inter-process communication after a user visits an external website. Threat hunting should look for WebView crashes or renderer process anomalies in device logs.

Why prioritize this

This vulnerability merits immediate patching due to its CVSS 8.8 severity, the ease of triggering (user interaction only), and the severe impact scope (confidentiality, integrity, and availability all affected). While not yet listed in CISA's KEV catalog as of the publication date, the attack surface is broad—any Android user or enterprise device using Chrome is at risk. The lack of authentication or special privileges required, combined with realistic attack scenarios through malicious websites or ads, elevates practical risk. Organizations with mobile-first workflows or users accessing sensitive data through Chrome should prioritize this above most other concurrent patches.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible, low-complexity attack that requires only user interaction to grant an attacker complete control over the confidentiality, integrity, and availability of the affected device. The attack vector (AV:N), access complexity (AC:L), and lack of required privileges (PR:N) indicate a highly exploitable vulnerability with a large attack surface. The requirement for user interaction (UI:R) prevents fully remote mass exploitation but does not substantially lower the risk in real-world scenarios where social engineering is effective. The unchanged scope (S:U) means impacts are confined to the compromised device rather than affecting other systems, but this does not diminish the severity of a complete device compromise.

Frequently asked questions