In Google Chrome on Android, an improperly implemented WebView in versions before 149.0.7827.155 allows a remote attacker who has already compromised the renderer process to create a malicious HTML page that can trigger a sandbox escape. This critical vulnerability could let the attacker execute code outside the renderer’s restricted context, potentially compromising device integrity and confidentiality. The weakness is identified as CWE‑693, reflecting inadequate limitation of control flow within the browser component.

All Android installations of Google Chrome older than version 149.0.7827.155 are affected. The issue resides in the WebView component used by mobile browsers and applications.

The CVSS score of 8.3 indicates a high severity. The EPSS score is below 1%, suggesting that widespread exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, an attacker who first gains access to the renderer process can craft a malicious web page that escapes the sandbox, potentially executing arbitrary code on the device. The risk remains significant for any Android device running Chrome on or before the specified version.