CVE Catalog
CVE-2026-11163
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk0.23%
14th percentile - higher than 14% of all known CVEs
Summary
In Google Chrome on Android prior to 149.0.7827.53, a use-after-free in Messages allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Risk Assessment
The vulnerability could allow an attacker to escape the browser sandbox, potentially leading to system compromise or access to sensitive data.
Recommendation
Update Google Chrome on Android to version 149.0.7827.53 or later, which includes the fix for Messages.
Original NVD description (English source)
Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)