This vulnerability involves a use-after-free condition in the WebAppInstalls feature of Google Chrome on Android devices before version 149.0.7827.53. Exploitation requires local attacker access and involves triggering the flaw via a crafted malicious file, potentially leading to arbitrary code execution. The issue was assigned CVE-2026-10923 and publicly disclosed on June 4, 2026. The vendor advisory linked is a general stable channel update announcement without explicit patch or remediation details for this specific vulnerability.

Successful exploitation could allow a local attacker to execute arbitrary code on affected Android devices running vulnerable versions of Google Chrome. This could lead to compromise of the browser process and potentially the device, depending on the attack context. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor advisory linked does not explicitly confirm a fix for this vulnerability, users should monitor official Google Chrome release notes and update to version 149.0.7827.53 or later once confirmed. Until then, avoid opening untrusted files locally in Chrome on Android.