Google CVE-2026-5288

Google Chrome on Android versions prior to 146.0.7680.178. Requires compromised renderer process (attacker must first achieve code execution within Chrome's renderer sandbox). Victim must visit or be directed to a crafted HTML page. Remote attacker leverages use-after-free to escape sandbox.

Although CVSS and EPSS metrics are unavailable for this CVE, the real-world risk is substantial. The Chromium severity classification of 'High' combined with sandbox escape capability indicates critical impact - renderer process compromise alone is typically medium risk, but sandbox escape elevates it to critical. The exploit requires a prerequisite (compromised renderer), which reduces attack surface compared to direct remote code execution, but the two-stage attack (web compromise → sandbox escape) is realistic in targeted scenarios. KEV status and POC availability are not confirmed in the provided data, but the vulnerability's technical specificity and patching urgency (vendor-released fix) suggest active research interest. This should be prioritized for patching despite the prerequisite requirement.

An attacker first compromises a website or advertising network to serve malicious HTML content. When a Chrome on Android user visits the compromised site, the malicious HTML triggers the use-after-free in WebView's memory management. The attacker leverages the memory corruption to break out of the renderer process sandbox and gain access to the Android device's broader system privileges, potentially stealing credentials, intercepting communications, or installing persistent malware. This two-stage attack (web compromise → sandbox escape) is realistic for targeted campaigns against high-value users, though no confirmed public exploit or KEV status is documented in the provided data.