Google Chrome Android CVE-2026-11097

Exploitation requires that the victim be using Google Chrome on Android running a version prior to 149.0.7827.53 - Chrome on other operating systems is not affected by this CVE. The CVSS UI:R parameter confirms that the victim must actively visit or be redirected to the attacker-controlled HTML page; fully passive or background exploitation is not possible. No attacker authentication is required (PR:N) and attack complexity is low (AC:L), meaning no special target-side configuration is needed beyond the victim using an unpatched Android Chrome version. Exploitation is bounded by scope unchanged (S:U), limiting impact to cross-origin data accessible within the browser's own security context - OS-level access or lateral movement is not achievable through this vulnerability alone. The mandatory user interaction is the primary real-world limiting factor for exploitation at scale.

The CVSS 6.5 score is driven by a network-reachable attack vector (AV:N), low complexity (AC:L), no required privileges (PR:N), and high confidentiality impact (C:H) - these factors alone suggest urgency. However, several signals moderate the real-world risk: the mandatory user interaction requirement (UI:R) prevents fully automated or drive-by exploitation without some social engineering component; the unchanged scope (S:U) confines impact to the browser's security boundary with no OS-level escalation path; and integrity and availability are entirely unaffected (I:N/A:N). EPSS at 0.03% (10th percentile) strongly corroborates that exploitation has not yet been observed at scale. The absence from CISA KEV further supports that this is not currently being weaponized in threat campaigns. Net assessment: this is a genuine medium-severity confidentiality risk for Android Chrome users, warranting prompt patching in enterprise mobile device management fleets, but it does not represent an emergency zero-day scenario.

An attacker registers or compromises a web domain and serves a crafted HTML page engineered to exploit the WebView cross-origin implementation flaw. The attacker lures an Android Chrome user to the page via a phishing link, malicious advertisement, or QR code redirect; upon page load, the malicious JavaScript silently reads data from a cross-origin resource - such as an authenticated API endpoint or session-bearing response - that the WebView inappropriately exposes. The exfiltrated data is transmitted to the attacker's server, potentially exposing session tokens, private user data, or other sensitive cross-origin content without any visible indication to the victim. No public exploit code has been identified at time of analysis.