Google Chrome CVE-2026-11167

Exploitation requires the attacker to have already achieved code execution inside the Chrome renderer process on Android - typically via a separate renderer-side vulnerability chained with this bug - and the victim must visit or be redirected to a crafted HTML page (UI:R user interaction). Affected platform is limited to Google Chrome on Android prior to 149.0.7827.53; desktop builds are not in scope per the description. The CVSS PR:N rating is misleading here: while no traditional authentication is needed, the precondition of a compromised renderer functionally limits exploitation to multi-stage attack chains rather than direct one-shot exploitation.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) yields a 9.6 score driven largely by Scope:Changed (sandbox escape) and full CIA impact, but this score is misleading in isolation because the description explicitly requires the attacker to have already compromised the renderer process - meaning this is realistically the second link in an exploit chain, not a standalone bug. EPSS of 0.03% (10th percentile) and the absence of CISA KEV listing or public POC indicate no current evidence of active exploitation. Chromium itself rated the bug Medium severity, which aligns better with operational reality than the NVD 9.6. Conflict to note: PR:N suggests no privileges needed, yet the description requires a prior renderer compromise - a known modeling quirk where chained vulnerabilities are scored as if the precondition is free. Treat this as a meaningful but not emergency patch, particularly for Android fleets where WebView is heavily used.

An attacker lures an Android user to a malicious or compromised website via phishing, ad injection, or a watering-hole page; the page first exploits an unrelated renderer-process vulnerability (or one chained with this CVE) to gain code execution inside the sandboxed renderer. The attacker then serves a crafted HTML payload that triggers the inappropriate WebView implementation to escape the sandbox into the host browser or hosting Android app process, potentially leading to broader device compromise. No public exploit is identified at time of analysis.