CVE-2026-84353 Overview
CVE-2026-84353 is a use-after-free vulnerability [CWE-416] in the Shared Tab Groups component of Google Chrome on Android. Versions prior to 152.0.7977.75 are affected. A remote attacker can exploit this flaw by convincing a user to visit a crafted HTML page. Successful exploitation permits arbitrary code execution outside the Chrome sandbox. Google's Chromium team rated the security severity as Critical.
Critical Impact
Attackers can execute arbitrary code outside the browser sandbox on Android devices, breaking the primary isolation boundary that protects the underlying operating system.
Affected Products
- Google Chrome for Android versions prior to 152.0.7977.75
- Chromium-based mobile browsers sharing the Shared Tab Groups component
- Android devices running vulnerable Chrome builds
Discovery Timeline
- 2026-09-02 - CVE-2026-84353 published to NVD
- 2026-09-03 - Last updated in NVD database
Technical Details for CVE-2026-84353
Vulnerability Analysis
The vulnerability resides in the Shared Tab Groups feature of Chrome on Android. Shared Tab Groups synchronize tab collections across users and devices, requiring complex object lifecycle management within the browser process. A use-after-free condition occurs when the component references memory that has already been freed. Because the flaw affects the browser process rather than the renderer, exploitation escapes the Chrome sandbox and grants code execution at the browser's privilege level.
The attacker requires user interaction, consistent with social engineering to lure the victim into visiting a crafted page. No authentication or elevated privileges are needed on the target device.
Root Cause
The root cause is improper object lifetime management in the Shared Tab Groups implementation. When shared tab state is manipulated in a specific sequence, a pointer continues to reference an object after it has been deallocated. Subsequent dereferencing of the freed memory allows an attacker to control execution flow through heap grooming and object replacement techniques standard to Chromium exploitation.
Attack Vector
Exploitation is remote and requires social engineering. The attacker hosts a crafted HTML page and induces the victim to open it in a vulnerable Chrome for Android build. The page triggers the use-after-free through interactions with Shared Tab Groups APIs, then leverages the dangling pointer to achieve arbitrary code execution outside the sandbox. The scope change reflects the sandbox escape: code runs with the privileges of the browser process rather than the restricted renderer.
See Chromium Issue #522307103 and the Google Chrome Stable Update for advisory details.
Detection Methods for CVE-2026-84353
Indicators of Compromise
- Chrome for Android crash reports referencing Shared Tab Groups components or heap corruption signatures
- Unexpected child processes spawned by the Chrome browser process on Android
- Outbound connections from Chrome to previously unknown hosts immediately after visiting a new URL
- Modifications to Chrome application data directories inconsistent with normal browsing activity
Detection Strategies
- Inventory Chrome versions across managed Android fleets and flag any build below 152.0.7977.75
- Monitor mobile threat defense telemetry for browser-originating exploitation behaviors and post-exploitation activity
- Correlate web proxy logs with device-side crash telemetry to identify pages that repeatedly trigger Chrome faults
Monitoring Recommendations
- Enroll Android endpoints in a mobile device management platform that reports installed browser versions in real time
- Alert on delayed Chrome updates beyond your patch SLA window
- Track user reports of unexpected browser crashes on pages containing tab-sharing or collaborative features
How to Mitigate CVE-2026-84353
Immediate Actions Required
- Update Google Chrome for Android to version 152.0.7977.75 or later through the Google Play Store
- Force-push the Chrome update to managed Android devices via enterprise MDM policy
- Advise users to avoid opening untrusted links until the patch is deployed across the fleet
- Validate patch installation by auditing Chrome version strings on representative devices
Patch Information
Google has released Chrome 152.0.7977.75 for Android, which remediates CVE-2026-84353. Refer to the Google Chrome Stable Update release notes for the full list of fixes. Tracking data is available in Chromium Issue #522307103.
Workarounds
- Disable the Shared Tab Groups feature via Chrome flags or enterprise policy where supported
- Restrict browsing to trusted sites through mobile web filtering until patches are applied
- Provide targeted user awareness guidance covering social-engineered links delivered via messaging apps and email
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
