Google has patched a sandbox escape vulnerability in Chrome’s WebView component for Android, disclosed June 4 under CVE-2026-11167. The flaw, rated “Medium” by Chromium engineers but scored 9.6 Critical in CISA’s enrichment, allows a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox through a crafted HTML page. All Chrome users on Android should update to version 149.0.7827.53 or later immediately.

The bug: a sandbox escape after renderer compromise

In Chrome’s security architecture, the sandbox is the wall that keeps malicious web content confined even if an attacker manages to hijack the renderer—the process that turns HTML and JavaScript into the page you see. CVE-2026-11167 is a crack in that wall. The vulnerability, described as “inappropriate implementation” in WebView, lets an attacker who controls the renderer potentially break out and access other parts of the device or app environment. That makes it a dangerous second-stage bug in an exploit chain.

According to Google’s advisory, the flaw exists in Chrome for Android before version 149.0.7827.53. The prerequisite—that the renderer is already compromised—means the bug is not a one-click “drive-by” attack by itself. However, browsers are complex beasts. Chrome 149, the very update that fixes this issue, also plugs hundreds of other holes, including
critical memory-safety bugs like use-after-free and heap buffer overflows that can serve as the initial infection vector. In the wild, attackers routinely chain together a renderer exploit with a sandbox escape to gain deeper control. So while CVE-2026-11167 may not be the headliner, it’s precisely the kind of vulnerability that turns a limited browser crash into a full device compromise.

Android WebView: the hidden browser inside every app

Many Android users never open Chrome. They click links in email, social media, banking apps, or identity portals, and those apps display web content seamlessly—using WebView. WebView is the embedded Chromium engine that Android apps rely on to render web pages without launching a separate browser. That means every app that shows a login form, a terms-of-service page, or a captive portal screen is dependent on the same underlying code that this vulnerability affects.

This is why CVE-2026-11167 is more than a Chrome-on-the-homescreen problem. Even if you never tap the Chrome icon, your device’s attack surface may still be exposed through any app that loads web content. For IT departments, this is especially concerning: a managed loan-origination app used by a bank teller might embed WebView to display a web form. If that WebView is unpatched, the device is at risk each time the app fetches a page—potentially from an attacker-controlled URL.

Why it’s rated Medium but scored Critical

Severity labels often confuse more than they clarify. Google’s Chromium team rated the vulnerability “Medium” internally, a judgment that factors in the need for a prior renderer compromise and Chrome’s existing exploit mitigations. CISA, however, using CVSS 3.1, assigned a base score of 9.6—Critical—based on the potential impact once exploited: high impact on confidentiality, integrity, and availability, with the sandbox boundary crossed (scope changed).

Neither rating is wrong. They answer different questions. The Medium severity tells browser developers how urgently to patch relative to other bugs in the release cycle. The Critical CVSS tells risk managers what could happen if the bug is used in an attack. For everyday users and IT administrators, the takeaway is simple: a sandbox escape in a foundational component like WebView deserves immediate attention regardless of the label. Treat it as high-priority.

Google’s fix: Chrome 149 released with a flood of patches

Chrome 149 was promoted to stable on June 2, 2026, for Windows, Mac, and Linux, with version 149.0.7827.53 for Linux and builds 149.0.7827.53/54 for Windows and Mac. The release notes announced a staggering 429 security fixes, of which CVE-2026-11167 is just one. This volume underscores that modern browsers are under continuous attack, and keeping them updated is not a monthly chore but a constant defense requirement.

For Android specifically, the fix lands through the Play Store as an update to Chrome and, on some devices, the Android System WebView component. After installation, the “about” screen should display version 149.0.7827.53 or higher. Because the vulnerability’s CPE configuration explicitly ties the flawed Chrome to the Android operating system, desktop installations of Chrome are not the primary targets. However, administrators should avoid assuming that a patched desktop environment means all clear if Android devices access corporate resources.

What to do now: update and inventory

For individual Android users:
1. Open the Play Store and check for updates to both Google Chrome and Android System WebView.
2. After updating, restart your device or at least close all apps that use web content to ensure the updated engine is loaded.
3. Verify the version by going to Chrome’s Settings > About Chrome. It should be 149.0.7827.53 or later.

For IT and security teams:
- Inventory mobile browsers. Use your mobile device management (MDM) tool to report installed Chrome and WebView versions across the fleet. Don’t assume OS patch level equals browser patch level.
- Enforce updates. Configure policies to require Chrome updates from the Play Store and, where possible, block access to corporate resources from devices running outdated browser components.
- Tune vulnerability scanners. Ensure your scanner correctly interprets the CPE logic. This CVE is scoped to Chrome on Android. A finding on a Windows desktop running Chrome 148 should be a false positive by platform; a finding on a managed Android tablet running Chrome 148 is a real exposure.
- Check conditional access rules. If you allow mobile access to Office 365, SSO portals, or sensitive web apps, make browser freshness a compliance signal. A device with an outdated WebView undermines all other controls.

The bigger picture: mobile browsers are enterprise endpoints

CVE-2026-11167 will not be the last Android WebView bug. Every month brings dozens of Chromium patches, many of which apply to the mobile engine. Yet many organizations still treat mobile browsers as consumer conveniences rather than managed endpoints. That’s a mistake. The browser is now the runtime for identity, documents, and internal applications. An unpatched WebView is a gateway past network perimeters and onto corporate systems.

This vulnerability is also a reminder that severity scores don’t tell the whole story. A Medium-rated sandbox escape might be the missing piece in an exploit chain you’d otherwise rate Critical. Instead of fixating on individual CVEs, build a process that treats all browser updates—especially on mobile—as urgent. The version number 149.0.7827.53 is the line; anything older is an open door.

Outlook: Chrome 150 will likely arrive within weeks, bringing more fixes and refinements. Android’s Project Mainline and Play Store update mechanisms increasingly separate browser patching from OS updates, which is good news for speed. The challenge remains: will users and IT departments treat those patches with the same urgency as a Windows cumulative update? For CVE-2026-11167, the safe answer begins with updating today.