Description

Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-25T21:18:20.117Z",
  "pubdate": "2026-08-25T21:18:20.117Z",
  "executiveSummary": "This vulnerability is an externally controlled reference issue affecting Google Chrome on Android versions prior to 152.0.7977.65.\nThe flaw exists within the WebView component, specifically allowing for a sandbox escape when an attacker has already achieved control over the renderer process.\nBy leveraging a specially crafted HTML page, a remote attacker can bypass existing security sandboxing mechanisms to execute arbitrary code with elevated privileges outside the renderer's restricted environment.\nThe vulnerability is classified as having Medium severity under the Chromium security framework.\nSuccessful exploitation requires the attacker to first compromise the renderer process, making this a secondary stage attack vector that significantly impacts the overall security posture of the Android device by breaking out of the primary containment process.\nThe primary risk involves the transition from a limited renderer process compromise to full execution context control within the WebView environment.",
  "technicalDetails": "The vulnerability originates from improper handling of externally controlled references within the WebView architecture of Google Chrome on Android. In Chromium-based browsers, the renderer process is subjected to a strict sandbox to prevent malicious web content from accessing system resources or the host application's memory space.\nThe root cause involves a flaw where the communication or reference mechanism between the sandboxed renderer process and the privileged browser process (or OS-level components) can be manipulated via a crafted HTML document. Specifically, an attacker who has gained control of the renderer—typically through a separate browser engine exploit—can utilize this reference-handling vulnerability to manipulate inter-process communication (IPC) or bridge calls.\nThe exploitation flow begins with the delivery of a malicious HTML payload to the target Android device. Upon rendering the content, the attacker triggers the initial renderer compromise. Once the renderer is subverted, the attacker interacts with the vulnerable WebView component to influence the reference pointers handled by the browser process. By providing crafted input into these references, the attacker forces the WebView to perform operations that circumvent the sandbox isolation boundaries.\nBecause the vulnerability involves 'externally controlled references,' it implies that the application fails to validate the integrity or the target of objects passed across the process boundary. This allows the attacker to redirect control flow or perform unauthorized memory operations that are outside the scope of the sandboxed environment. Consequently, the attacker can execute arbitrary code with the effective privileges of the WebView component, which often operates with significantly higher access rights than the sandboxed renderer process.\nThe affected component is the WebView interface within Google Chrome on Android. The vulnerability is present in versions prior to 152.0.7977.65. Authentication is not required for the initial payload delivery; however, the attacker must have a functional exploit to compromise the renderer process first. The attack is network-exposed, as it can be triggered via a crafted HTML page served over HTTP or HTTPS. Post-exploitation, the attacker gains the ability to execute code outside the sandbox, which may lead to further system compromise, data theft, or persistence depending on the specific permissions granted to the parent application hosting the WebView."
}