Description
Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)
Published: 2026-06-04
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A use‑after‑free bug in Chrome’s WebView on Android enables a local attacker to run arbitrary code by supplying a malicious file. The flaw, classified as CWE‑416 and CWE‑825, can compromise the device’s confidentiality and integrity. The vulnerability is considered medium severity by Chromium’s internal scoring system.

Affected Systems

Google Chrome for Android versions earlier than 149.0.7827.53 are affected. The issue is specific to the WebView component that renders content from locally stored files.

Risk and Exploitability

The exploit requires a local attacker who can place a crafted file on the device – for example via a malformed download or malicious app. With a CVSS score of 7.8, the vulnerability is considered high severity, but the EPSS score indicates a low probability (<1%) and the vulnerability is not listed in CISA’s KEV catalog. The risk remains moderate but should be mitigated promptly by updating Chrome.

Generated by OpenCVE AI on June 7, 2026 at 14:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome for Android to version 149.0.7827.53 or newer.
  • Enforce device security policies to restrict the execution of untrusted files or disable WebView where possible until the patch is applied.
  • If an update is not yet available, avoid opening suspicious files and restrict user privileges to prevent local code execution.

Generated by OpenCVE AI on June 7, 2026 at 14:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6325-1 chromium security update
History

Mon, 08 Jun 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Sun, 07 Jun 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in WebView
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 05 Jun 2026 20:15:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Android WebView Allows Local Code Execution via Malicious File

Fri, 05 Jun 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 05 Jun 2026 04:45:00 +0000

Type Values Removed Values Added
Title Use After Free in Chrome Android WebView Allows Local Code Execution via Malicious File

Fri, 05 Jun 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 04 Jun 2026 23:15:00 +0000

Type Values Removed Values Added
Description Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malicious file. (Chromium security severity: Medium)
Weaknesses CWE-416
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-06T12:17:51.342Z

Reserved: 2026-06-04T17:06:43.450Z

Link: CVE-2026-11072

cve-icon Vulnrichment

Updated: 2026-06-05T15:45:01.083Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-04T23:17:11.843

Modified: 2026-06-08T15:51:36.153

Link: CVE-2026-11072

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-02T00:00:00Z

Links: CVE-2026-11072 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-07T14:30:16Z

Weaknesses