Description
Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Published: 2026-06-08
Score: 8.3 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a use‑after‑free flaw in the printing subsystem of Google Chrome for Android. A remote attacker who can compromise a renderer process could craft a malicious HTML page that triggers a sandbox escape, potentially allowing execution of code outside the browser sandbox.

Affected Systems

Google Chrome on Android versions prior to 149.0.7827.103 are affected. Users running any earlier stable channel build of Chrome on Android devices are at risk until an update is applied.

Risk and Exploitability

Because the flaw requires a compromised renderer process and the delivery of a crafted HTML payload, the attack vector is likely Remote Delivery over the internet. The CVSS score is 8.3, the EPSS score is in the interval (0%,1%), and the vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited in the wild. Nonetheless, the potential for sandbox escape warrants immediate attention, especially in environments where Chrome is used extensively.

Generated by OpenCVE AI on June 11, 2026 at 01:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install Chrome version 149.0.7827.103 or later on the affected Android devices.
  • Ensure that the device remains subscribed to Chrome's stable channel to receive the most recent security updates automatically.
  • If the update cannot be applied immediately, configure the device or enterprise policy to block or restrict the execution of print commands triggered from untrusted content.

Generated by OpenCVE AI on June 11, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6337-1 chromium security update
History

Thu, 11 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Use after free in Printing
Weaknesses CWE-825
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 09 Jun 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Tue, 09 Jun 2026 04:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Android Printing Enables Potential Sandbox Escape

Tue, 09 Jun 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 09 Jun 2026 01:15:00 +0000

Type Values Removed Values Added
Title Use-After-Free in Chrome Android Printing Enables Potential Sandbox Escape

Tue, 09 Jun 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Mon, 08 Jun 2026 23:45:00 +0000

Type Values Removed Values Added
Description Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-416
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-06-09T03:56:13.924Z

Reserved: 2026-06-08T21:33:38.648Z

Link: CVE-2026-11647

cve-icon Vulnrichment

Updated: 2026-06-09T01:38:39.760Z

cve-icon NVD

Status : Analyzed

Published: 2026-06-09T00:16:47.583

Modified: 2026-06-09T20:30:30.190

Link: CVE-2026-11647

cve-icon Redhat

Severity : Important

Publid Date: 2026-06-08T00:00:00Z

Links: CVE-2026-11647 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-06-11T02:00:16Z

Weaknesses