External risk intelligence

Chrome for Android Sandbox Escape via Malicious HTML.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-11163

This vulnerability exists within a specific client-side application (Google Chrome for Android). It requires a user to interact with a crafted HTML page, meaning the attack surface is local to the client device rather than a public-facing network service, appliance, or infrastructure component.

Use After Free

Google Chrome

before 149.0.7827.53

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A use-after-free vulnerability in the Messages component of Google Chrome on Android could allow a remote attacker to escape the browser sandbox via a malicious HTML page. This could potentially lead to unauthorized access to sensitive data or system functions on affected devices.

Flaw allows sandbox escape via malicious web pages.
Matters if Android Chrome is used for sensitive tasks.
Confirm if Android Chrome is in use and relevant.

Attack Path

How an attacker could exploit the issue

An attacker could lure a user to a malicious website, leading to a critical security bypass in the Chrome browser on Android. This could allow an attacker to gain elevated privileges on the device.

Requires user to visit a malicious site.
Triggered by a crafted HTML page.
Allows sandbox escape and privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome on Android could allow a remote attacker to escape the browser sandbox via a malicious HTML page. This could impact the confidentiality and integrity of system data and potentially lead to a full device compromise when users visit a crafted webpage.

System data and user information could be affected.
Exposure could happen via a malicious HTML page.
May lead to sandbox escape and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Google Chrome on Android. Identifying affected devices and their owners is the first crucial step. Given the nature of the vulnerability, the Android platform owners and the Google Chrome application owners are likely responsible for remediation, in coordination with the security and network teams to assess exposure and plan mitigation.

Identify Chrome on Android devices.
Verify user interaction and reachability.
Plan vendor coordination and remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android?

Google Chrome for Android is a web browser built on the Chromium engine. It provides mobile users with internet access, allowing them to render HTML, execute JavaScript, and interact with web applications on Android devices. This specific software component handles network requests and message processing, which are foundational for how the browser communicates with remote servers.

What does use-after-free mean in CVE-2026-11163?

This vulnerability, classified as CWE-416, occurs when software continues to use a memory address after that memory has been cleared or released. In this instance, the Messages component in Chrome fails to properly manage memory, creating a weakness that an attacker can manipulate. If exploited, this flaw can bypass the browser's sandbox security, which is designed to prevent malicious websites from accessing other areas of the device or system.

How is this vulnerability triggered?

An attacker triggers this flaw by luring a user to visit a specially crafted, malicious HTML page using the affected browser. The vulnerability does not trigger through passive network traffic or background system processes; it requires active interaction where the user loads the hostile webpage. Simply using the browser for legitimate websites or viewing standard, non-malicious content does not initiate the attack path.

Do I need to worry about this on my servers?

According to Halo Surface Signal, this vulnerability is very unlikely to affect infrastructure, as it resides within a client-side application specifically on Android devices. Because it requires a user to interact with a crafted page, it is not a public-facing network service or appliance vulnerability. Your focus should be on endpoints and mobile devices used by individuals rather than your server-side environment.

When should I update my software?

You should prioritize updating Google Chrome on all Android devices to version 149.0.7827.53 or later as soon as possible. Start by auditing your inventory to locate devices running older versions of the browser. Once identified, ensure these devices receive the latest stable channel update from the official application store to resolve the memory management flaw and restore proper sandbox protection.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.