Google Chrome CVE-2026-11647

Attacker must have already compromised the Chrome renderer process on Android (per the CVE description's explicit precondition), the target must be running Chrome for Android at a version below 149.0.7827.103, the victim must be coaxed into loading a crafted HTML page and into the user interaction required by CVSS UI:R (consistent with invoking a print action or related Printing UI flow), and attack complexity is High (AC:H) meaning the attacker must win a memory-layout race or otherwise satisfy non-trivial conditions to reliably reclaim the freed Printing object. Limiting factors that constrain real-world exploitation: the renderer-compromise prerequisite means this cannot stand alone as an n-day, the Android-only scope excludes desktop Chrome users, and the UI:R + AC:H combination makes drive-by mass exploitation impractical compared to a single-stage RCE.

CVSS 8.3 is driven by Scope:Changed (sandbox escape crosses a security boundary) and full CIA impact, but the vector explicitly marks Attack Complexity High, User Interaction Required, and - critically - assumes the attacker has already compromised the renderer process, which is itself a non-trivial precondition not reflected in PR:N. This places real-world risk well below what the raw 8.3 implies: it is the second half of an exploit chain, not a single-shot RCE. No KEV listing and no public POC identified at time of analysis, and EPSS data was not provided; the Chromium reporter (chrome-cve-admin@google.com) and internal issue tracker reference (issues.chromium.org/issues/502156940) suggest this was found internally or via responsible disclosure rather than discovered in-the-wild. Priority is high for Android fleet patching but this is not a drop-everything emergency in the absence of a paired renderer RCE actively chained against it.

An attacker lures the victim to a malicious HTML page that first exploits a separate, unpatched renderer-process vulnerability to gain code execution inside the sandboxed renderer, then triggers the crafted print flow to drive the Printing IPC into the use-after-free condition, requiring the user to interact with a print dialog or print-related action. Successful exploitation of the freed Printing object corrupts memory in the browser process and yields sandbox escape on Android, granting the attacker the full privileges of the Chrome browser process outside site isolation. No public exploit identified at time of analysis, but historical Chromium UAF bugs in Printing have been weaponized into full chains by commercial offensive vendors.