CVE-2026-9888: Critical Chrome WebView Sandbox Escape on Android

Technical summary

CVE-2026-9888 is a use-after-free (CWE-416) vulnerability in Google Chrome's WebView implementation on Android. The flaw exists in memory management within the WebView component; when a renderer process references freed memory, an attacker who has already compromised the renderer can trigger this condition via crafted HTML to escape the sandbox. The vulnerability requires high interaction complexity (the attacker must already control the renderer process and the user must interact with a malicious page), but if exploited, yields high confidentiality, integrity, and availability impact. Chromium's security team classified it as Critical severity.

Business impact

Successful exploitation could allow attackers to break out of Chrome's sandbox isolation, potentially granting them access to sensitive user data, system resources, or the ability to install malware on affected Android devices. For enterprises managing Android devices, this represents a risk to corporate data stored in or accessed through Chrome on employee or managed devices. Users relying on WebView-based applications (which use Chrome's rendering engine) on Android are also at risk.

Affected systems

Google Chrome on Android versions prior to 148.0.7778.216. Any Android application using WebView (Chrome's rendering component) is potentially affected if running a vulnerable version. This includes Chrome itself, as well as third-party apps that embed WebView for content rendering.

Exploitability

While the CVSS vector indicates high attack complexity, exploitation requires two key preconditions: the attacker must first compromise the renderer process, and the user must interact with a crafted HTML page. This is not a trivial one-click exploit scenario. However, because renderer compromises can result from other vulnerabilities or social engineering, and because the attack complexity is rated 'high' rather than 'very high,' this should not be dismissed as low-risk. The fact that it is not listed on CISA's KEV catalog does not reduce its technical severity—it simply means it is not yet confirmed to be actively exploited in the wild.

Remediation

Update Google Chrome on Android to version 148.0.7778.216 or later. Users should enable automatic updates if they have not already done so. Organizations should verify patch status across managed Android devices running Chrome or WebView-based applications, and prioritize deployment of the update given the high impact potential of a sandbox escape.

Patch guidance

Google has issued Chrome version 148.0.7778.216 to address this vulnerability. Users can check their current version by navigating to Chrome Settings > About Chrome, which will automatically check for updates and apply them if available. For enterprises with managed Android deployments, use Mobile Device Management (MDM) solutions to enforce Chrome updates across devices. Verify patch deployment by confirming devices report version 148.0.7778.216 or later in your MDM console.

Detection guidance

Monitor Chrome and WebView versions on Android devices using endpoint detection tools or MDM solutions to identify systems still running versions prior to 148.0.7778.216. Log analysis should flag attempts to trigger use-after-free conditions if your security tools capture renderer process behavior; however, this typically requires deep instrumentation. Detection of active exploitation is difficult without vulnerability-specific signatures, so patch-driven inventory management is the primary detection approach.

Why prioritize this

This vulnerability merits high priority despite not yet appearing on the KEV list. The combination of a high CVSS score (8.3), Critical Chromium severity rating, and the sandbox-escape nature of the flaw make it a significant risk to confidentiality, integrity, and availability. Android devices often store or access sensitive corporate and personal data; a breach of Chrome's sandbox could have cascading consequences. The patch is already available and straightforward to deploy, making prioritization practical.

Risk score, explained

The CVSS 3.1 score of 8.3 (HIGH severity) reflects: network-based attack vector (user must visit a malicious page), high attack complexity (requires prior renderer compromise), no privileges required, user interaction required, and changed scope with high impact across confidentiality, integrity, and availability. While the score is not in the critical range of 9.0+, the 'Changed Scope' designation and high impact ratings indicate that successful exploitation can compromise trust boundaries—a hallmark of sandbox escape vulnerabilities. The practical severity is amplified by the ubiquity of Chrome on Android and WebView's use across Android applications.

Frequently asked questions