External risk intelligence

Google Chrome for Android WebView Sandbox Escape

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-11167

This vulnerability affects WebView in Google Chrome on Android, which is a client-side component integrated into local applications. It is not an internet-facing service, gateway, or public API, and requires user interaction via a crafted page within a local context to be triggered.

Google Chrome

before 149.0.7827.53

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a security issue within the WebView component of Google Chrome on Android. The vulnerability could allow an attacker who has already compromised a device's renderer process to escape the browser's sandbox, potentially impacting sensitive data and system integrity. The main concern is confirming relevance and exposure to the affected technology.

A code flaw in Chrome's Android WebView.
Could allow unauthorized system access.
Confirm if this technology is in use.

Attack Path

How an attacker could exploit the issue

An attacker who has already compromised the renderer process can leverage this vulnerability by directing a user to a malicious HTML page. This could allow them to escape the browser's sandbox, potentially leading to broader system compromise.

Requires prior renderer process compromise.
Triggered by viewing a crafted HTML page.
Allows sandbox escape to other processes.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker who has already compromised the renderer process could potentially escape the Chrome Android sandbox when a user visits a malicious HTML page. This could affect the integrity and availability of the device's user data and services.

Device user data and services.
Malicious HTML page interaction.
Sandbox escape and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the WebView component within Google Chrome on Android, a client-side technology. Responsibility for addressing this typically falls to the teams managing end-user devices and the applications that utilize the WebView component. The initial step involves identifying all Android devices running affected Chrome versions, confirming their exposure, and assigning ownership to the appropriate application or device management team for remediation planning.

Application and device owners should lead remediation.
Verify user interaction and application context.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome WebView for Android?

It is a system component that allows Android applications to display web content directly within their own interface without needing to launch a separate browser app. Many mobile apps use it to render in-app help pages, login screens, or dynamic content feeds. Because it is embedded into these applications, it shares the same environment and permissions as the app hosting it.

What does CWE-250 mean in the context of CVE-2026-11167?

CWE-250 refers to Execution with Unnecessary Privileges. In this case, the vulnerability allows an attacker who has already gained control of the browser's internal renderer process to break out of the software 'sandbox.' This sandbox is a security boundary meant to restrict the code to a limited area. By escaping it, the attacker might perform actions or access data that the browser component should not normally be allowed to reach.

How is this WebView vulnerability triggered?

The issue is triggered when a user is convinced to navigate to a specifically crafted malicious HTML page while using an affected application. It is important to note that simply having the vulnerable software installed is not enough; the bug does not trigger automatically in the background. It requires the prerequisite of a prior compromise of the renderer process, meaning the attacker must first successfully exploit a separate, initial vulnerability to gain that foothold.

Is my organization's infrastructure at risk?

According to Halo Surface Signal, this risk is very unlikely for typical server-side infrastructure. Because this affects a client-side component on Android devices, it is not an internet-facing service or public API. The risk is limited to mobile devices where users interact with untrusted web content through apps using the WebView component. Most backend systems or internal gateways are not exposed to this type of client-side sandbox escape.

What should I do if my devices use this software?

Your first step is to identify all Android devices within your environment running Chrome versions earlier than 149.0.7827.53. Since this is an embedded component, coordinate with the teams that manage your mobile device fleet or develop your internal Android applications. Focus on planning an update cycle to move these devices to a patched version, ensuring that the applications utilizing WebView receive the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.