CVE-2026-11080: Android WebView Use-After-Free Flaw Patched in Chrome 149

Google has assigned CVE-2026-11080 to a freshly disclosed use-after-free vulnerability lurking in Android WebView. The flaw, rated medium severity, came to light on June 4, 2026, and affects Google Chrome for Android before version 149.0.7827.53. Users who rely on Chrome or Android apps that render web content through WebView should patch immediately.

Android WebView is the system component that lets apps display web pages without bouncing users out to a full browser. From in-app browsers to login screens, WebView handles it all. When a vulnerability crops up here, the ripple effects can reach far beyond Chrome itself—any app embedding WebView inherits the risk. In this case, a use-after-free (UAF) bug means attackers could potentially execute arbitrary code, leak sensitive data, or crash the app entirely.

The June 4 disclosure arrived alongside the Chrome 149 stable channel update. Build 149.0.7827.53 rolled out to Android devices via the Play Store, containing the fix among other security tweaks. Google withheld technical details initially—standard practice to give users time to update before attackers reverse-engineer the patch. What we do know: a use-after-free occurs when a program continues to reference memory after it has been freed. If an attacker can corrupt that dangling pointer, they can redirect execution flow. In WebView’s context, a maliciously crafted webpage might trigger the bug, leading to sandbox escape or code execution with the app’s privileges.

Medium severity doesn’t mean ignorable. It puts CVE-2026-11080 in the same bracket as dozens of WebView bugs that have been exploited in the wild over the years. The CVSS score and vector aren’t public yet, but typical medium UAFs require either user interaction or specific conditions—like luring a victim to a booby-trapped site while the vulnerable WebView is loaded. Still, for enterprise environments or anyone handling sensitive data on Android, the risk is real. Google’s own threat analysis group hasn’t flagged active exploitation, but silence isn’t safety.

How to protect your device

Updating Chrome on Android is the first line of defense. Open the Play Store, search for Chrome, and hit Update if available. Version 149.0.7827.53 or higher means you’re covered. For those on older Android versions that don’t receive Chrome updates through the store (Android 7 and below), the fix may arrive via a system WebView update instead—check under Settings > System > Advanced > System Update for any pending patches.

It’s not just the Chrome app. Many apps bundle their own WebView implementations or rely on Android System WebView, which is updated alongside Chrome or independently in some Android builds. To ensure system-wide protection, validate Android System WebView is also on the latest version. Head to Settings > Apps > Android System WebView, tap “App details in store,” and update if possible. This dual-update approach closes the door on UAF exploitation across every app that leans on WebView.

What this means for business and mobile security

Organizations managing Android fleets through MDM policies should push Chrome and WebView updates immediately. The medium rating might lull IT admins into complacency, but UAFs are unpredictable. Even without public exploit code, determined attackers could chain CVE-2026-11080 with other vulnerabilities to compromise devices. Financial apps, email clients, and any tool that loads web content inside an activity are potential targets.

On the desktop side, Windows and macOS Chrome users can breathe easy—this CVE is Android-specific. Desktop Chrome 149 ships with its own set of patches (check chrome://settings/help to trigger an update), but the WebView bug only manifests in Android’s rendering engine. That said, keeping all Chrome installs current is still wise; the 149 release patched 11 other security issues across platforms.

Broader context: WebView as a ticking clock

Android WebView has a long history of critical bugs. Because it’s deeply integrated into the OS and updated frequently, it’s a prime target for exploit developers. Google has hardened WebView over the years with site isolation, improved sandboxing, and a rapid release cadence, but use-after-free vulnerabilities continue to surface. Memory-unsafe languages like C++ underpin the WebView codebase, and despite ongoing efforts to adopt Rust and other safe languages, legacy code remains a challenge.

The medium severity classification often reflects the difficulty of reliable exploitation rather than the potential damage. A UAF that crashes the browser might be a denial-of-service annoyance; one that grants code execution could be a catastrophe. Without the full technical report—expected in the coming weeks after most users have updated—organizations should assume the worst-case scenario matches the vulnerability class: possible arbitrary code execution within the context of the affected app.

Update timeline and disclosure details

Google’s Chrome Releases blog notes the update includes “one medium-severity WebView UAF reported by an external researcher.” The credited finder and bounty amount haven’t been disclosed, though Google typically names contributors once the embargo lifts fully.

What to do if you can’t patch immediately

For some users—especially those with managed devices or restricted Play Store access—immediate updating isn’t feasible. In those cases, limit risk by avoiding untrusted websites in apps that use WebView. Disable JavaScript in WebView settings if your device allows it (Developer Options > WebView implementation), but this may break legitimate functionality. A more practical fallback: use alternative browsers like Firefox or Brave until the update is applied, though keep in mind that many apps still use the system WebView under the hood.

A reminder for the Windows community

Even though CVE-2026-11080 doesn’t directly touch Windows, this incident reinforces the importance of cross-platform update hygiene. Chrome 149 for Windows includes fixes for multiple high-severity flaws, and the desktop version shares a significant portion of its rendering engine with Android. A use-after-free in one platform’s WebView could hint at similar patterns in other parts of Chromium. Windows users should take this opportunity to verify their Chrome install is at version 149.0.7827.53 or later.

Looking ahead

Google will likely publish the technical root cause in the Chromium bug tracker within 90 days, as per its disclosure policy. Until then, the medium label should not breed apathy. Update your devices, audit your app WebView usage, and keep an eye on the Android Security Bulletin for any late-breaking patches. In a mobile-first world, a WebView bug is never just a browser bug—it’s a doorway into every app that touches the web.