CVE-2026-9977: Chrome Android WebShare Sandbox Escape (CVSS 8.3)

Technical summary

CVE-2026-9977 is a sandbox escape vulnerability in the WebShare implementation of Google Chrome on Android versions prior to 148.0.7778.216. The issue stems from inadequate validation of untrusted input within the WebShare subsystem. An attacker with renderer process compromise can craft a malicious HTML page that exploits this validation gap to escape the sandbox isolation layer. The vulnerability is classified as CWE-20 (Improper Input Validation) and carries a CVSS 3.1 score of 8.3 (High severity), reflecting both the potential for privilege escalation and the requirement for renderer-level compromise as a prerequisite.

Business impact

A successful exploitation chain targeting this vulnerability could enable an attacker to move from browser renderer compromise to native device-level code execution on Android devices. For organizations, this means Chrome users—particularly on mobile platforms where device compromise can unlock sensitive corporate data, email, authentication tokens, and enterprise network access—face elevated risk if exposed to malicious content on compromised renderers. The need for prior renderer compromise means this is primarily a concern in scenarios where users have already encountered another exploit or where an attacker has already established a foothold in the browser process.

Affected systems

The vulnerability affects Google Chrome on Android devices running versions prior to 148.0.7778.216. Desktop versions of Chrome are not mentioned in the advisory, suggesting this is specific to the Android WebShare implementation. Any Android user running an unpatched version of Chrome in this version range is potentially at risk if their renderer process becomes compromised through another attack vector.

Exploitability

While the vulnerability itself has a high CVSS score reflecting potential impact, actual exploitation requires a multi-stage attack chain. An attacker must first compromise the Chrome renderer process—typically requiring a separate exploit (such as a use-after-free or buffer overflow in Chrome's rendering engine). Once renderer-level compromise is achieved, the attacker can then deploy the crafted HTML page to escape the sandbox. This requirement for prior renderer compromise makes it unlikely to be exploited in opportunistic, one-click attack scenarios, but it is a significant concern in targeted attack campaigns or where multiple vulnerabilities are chained together. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Users should update Google Chrome on Android to version 148.0.7778.216 or later as soon as possible. This patch version addresses the insufficient input validation in WebShare and eliminates the sandbox escape pathway. Organizations managing Android devices should prioritize this update, particularly for devices with sensitive data or enterprise network access. No workarounds are available; patching is the definitive remediation.

Patch guidance

Update Chrome on Android to version 148.0.7778.216 or later. Users can check their current version by opening Chrome, navigating to Settings > About Chrome, and allowing automatic updates to complete. Enterprise administrators deploying Chrome across managed Android devices should verify patch deployment through their mobile device management (MDM) platform. Confirm that the version reported by the device matches or exceeds 148.0.7778.216 before considering the vulnerability mitigated.

Detection guidance

Monitor Chrome version telemetry across your Android fleet for devices running versions prior to 148.0.7778.216. In environments where renderer-level exploits have been detected (e.g., through endpoint detection and response tools or behavioral analysis), prioritize verification that the WebShare sandbox escape has not been attempted. Logs from attempted Chrome sandbox escapes may appear as unusual process creation, elevated privilege acquisition, or unexpected native code execution originating from the Chrome process—though these signals are often obscured in production environments. Focus detection efforts on identifying unpatched Chrome versions rather than post-exploitation artifacts, given the rarity of in-the-wild exploitation.

Why prioritize this

This vulnerability merits high priority for environments where Android Chrome is widely deployed, particularly where users access sensitive data or where multi-stage attack chains against mobile devices are a realistic threat model. However, organizations without prior evidence of renderer-level exploits targeting their users can prioritize this slightly below critical vulnerabilities that require no prerequisites. The requirement for prior renderer compromise reduces immediate urgency compared to direct, no-interaction sandbox escapes, but it should not be deprioritized indefinitely—patch within 30 days of release for most organizations.

Risk score, explained

The CVSS 3.1 score of 8.3 (High) reflects the serious consequences of a successful exploit (complete compromise of the affected system) balanced against the requirement for renderer-level compromise as a precondition and the need for user interaction (UI:R). The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H captures network-based delivery of the malicious HTML page, high attack complexity (due to the prerequisite compromise), no privilege requirement for the initial attack vector, required user interaction, and scope change with high impact across confidentiality, integrity, and availability. The high score appropriately emphasizes the potential for full device compromise while acknowledging the precondition for renderer-level access.

Frequently asked questions