CVE-2026-11072 is a use-after-free vulnerability (CWE-416) in the WebView component of Google Chrome on Android. It affects versions prior to 149.0.7827.53 and enables a local attacker to execute arbitrary code via a crafted malicious file. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and impacts confidentiality, integrity, and availability. The vendor advisory linked does not explicitly state patch availability or remediation details.

Successful exploitation allows local attackers to execute arbitrary code on affected devices, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability requires local access and user interaction, limiting remote exploitation but still posing a significant risk on compromised or shared devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to version 149.0.7827.53 or later once confirmed available. Until then, avoid opening untrusted files in Chrome WebView on Android.