What is the CVSS score of CVE-2026-11172?

CVE-2026-11172 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11172?

Google Chrome for Android versions prior to 149.0.7827.53 contain a UI spoofing vulnerability in the Contact Picker that could allow attackers to deceive users into disclosing contact information…. A patch is available.

How to fix or mitigate CVE-2026-11172?

Within 24 hours: Determine Chrome on Android adoption across employee base and identify business-critical users. Within 7 days: Deploy Chrome 149.0.7827.53 or later via Mobile Device Management (MDM) to all Android devices. Within 30 days: Verify deployment compliance and disable older Chrome versions if organizational policy permits.

Google Chrome CVE-2026-11172

EUVD-2026-34633 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-5vf7-rmxm-wgj7

Information Disclosure Google

8.8

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:30 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to misrepresent the Contact Picker security UI via a crafted HTML page, potentially tricking users into disclosing contact information. Chromium rates the underlying severity as Medium, and no public exploit has been identified at time of analysis. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw resides in Chrome's Contact Picker API, a web platform feature on Android that lets sites request access to selected device contacts via a browser-mediated picker UI. CWE-451 (User Interface Misrepresentation of Critical Information) indicates the picker fails to convey origin or trust context accurately, so a crafted page can manipulate the presentation of the security UI. Because Contact Picker is Android-only, the vulnerability is constrained to the Chromium Android port, specifically Chrome builds prior to 149.0.7827.53 on that platform.

RemediationAI

Vendor-released patch: Chrome for Android 149.0.7827.53 - update Chrome on Android devices to this version or later via Google Play, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and Chromium issue https://issues.chromium.org/issues/502328201. For managed Android fleets, push the update via MDM/EMM policy and verify minimum version compliance. If patching must be delayed, a partial workaround is to disable or deny the Contact Picker permission for untrusted sites (Site Settings → Contacts) so the spoofed UI cannot extract contact data; the trade-off is that legitimate sites relying on the Contact Picker API will also be blocked. User-awareness reminders about scrutinizing picker prompts on unfamiliar sites help but are not a substitute for the update.