What is the CVSS score of CVE-2026-11172?

CVE-2026-11172 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Google Chrome are affected by CVE-2026-11172?

Google Chrome for Android versions prior to 149.0.7827.53 contain a UI spoofing vulnerability in the Contact Picker that could allow attackers to deceive users into disclosing contact information…. A patch is available.

How to fix or mitigate CVE-2026-11172?

Within 24 hours: Determine Chrome on Android adoption across employee base and identify business-critical users. Within 7 days: Deploy Chrome 149.0.7827.53 or later via Mobile Device Management (MDM) to all Android devices. Within 30 days: Verify deployment compliance and disable older Chrome versions if organizational policy permits.

Google Chrome CVE-2026-11172

EUVD-2026-34633 HIGH

User Interface (UI) Misrepresentation of Critical Information (CWE-451)

2026-06-04 chrome-cve-admin@google.com

GHSA-5vf7-rmxm-wgj7

Information Disclosure Chrome Google

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

4.3 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 18:30 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

8.8 (HIGH)

CVE Published

Jun 04, 2026 - 23:17 nvd

UNKNOWN (no severity yet)

CVE Published

Jun 04, 2026 - 23:17 nvd

HIGH 8.8

DescriptionCVE.org

Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

UI spoofing in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to misrepresent the Contact Picker security UI via a crafted HTML page, potentially tricking users into disclosing contact information. Chromium rates the underlying severity as Medium, and no public exploit has been identified at time of analysis. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Lure victim to malicious page

Delivery

Invoke Contact Picker via crafted HTML

Exploit

Spoof picker security UI

Execution

User confirms selection believing trusted origin

Impact

Exfiltrate disclosed contact data

Access

Lure victim to malicious page

Delivery

Invoke Contact Picker via crafted HTML

Exploit

Spoof picker security UI

Execution

User confirms selection believing trusted origin

Impact

Exfiltrate disclosed contact data

Vulnerability AssessmentAI

Exploitation	Exploitation requires the victim to use Google Chrome on Android at a version below 149.0.7827.53, to visit an attacker-controlled or attacker-influenced web page, and to interact with the Contact Picker prompt (UI:R in the CVSS vector); no authentication is needed (PR:N) and the attack is network-reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	Signals here conflict and warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A user on a pre-149.0.7827.53 Chrome Android build visits an attacker-controlled page that invokes the Contact Picker with crafted HTML so the security UI misrepresents the requesting origin or selection scope. Believing they are sharing data with a trusted site, the user confirms the picker and leaks contact details to the attacker. …
Remediation	Vendor-released patch: Chrome for Android 149.0.7827.53 - update Chrome on Android devices to this version or later via Google Play, referencing the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html and Chromium issue https://issues.chromium.org/issues/502328201. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Determine Chrome on Android adoption across employee base and identify business-critical users. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Chrome

View all

CVE-2026-3910 HIGH Act Now POC

8.8 Mar 13

Chrome's V8 JavaScript engine contains an inappropriate implementation (CVE-2026-3910, CVSS 8.8) that allows remote atta

CVE-2026-3909 HIGH Act Now POC

8.8 Mar 13

Google Chrome's Skia graphics library contains an out-of-bounds write (CVE-2026-3909, CVSS 8.8) enabling remote attacker

CVE-2026-5281 HIGH Act Now POC

8.8 Apr 01

Remote code execution in Google Chrome prior to version 146.0.7680.178 via a use-after-free vulnerability in the Dawn gr

CVE-2025-5419 HIGH Act Now POC

8.8 Jun 03

Chrome's V8 JavaScript engine contains an out-of-bounds read and write vulnerability (CVE-2025-5419, CVSS 8.8) enabling

CVE-2026-2441 HIGH Act Now POC

8.8 Feb 13

Google Chrome's CSS engine contains a use-after-free vulnerability (CVE-2026-2441, CVSS 8.8) that allows remote attacker

CVE-2025-6554 HIGH Act Now POC

8.1 Jun 30

Chrome's V8 engine contains a type confusion vulnerability (CVE-2025-6554, CVSS 8.1) enabling arbitrary read/write opera

CVE-2025-13223 HIGH Act Now

8.8 Nov 17

Google Chrome V8 contains a type confusion vulnerability in the JavaScript engine, the second V8 type confusion zero-day

CVE-2025-27038 HIGH Act Now

7.5 Jun 03

Qualcomm Adreno GPU drivers in Chrome contain a use-after-free vulnerability (CVE-2025-27038, CVSS 7.5) enabling memory

CVE-2024-12450 CRITICAL Act Now POC

9.8 Mar 20

In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities.

CVE-2025-6179 CRITICAL Act Now POC

9.8 Jun 16

Critical permissions bypass vulnerability in Google Chrome OS 16181.27.0 that allows local attackers to disable extensio

CVE-2025-49713 HIGH This Week POC

8.8 Jul 02

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized

CVE-2025-2073 HIGH This Week POC

8.8 Apr 16

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

View all

CVE-2025-8043 CRITICAL POC

9.8

CVE-2025-7021 MEDIUM POC

6.5

CVE-2026-0907 CRITICAL

9.8

CVE-2026-0906 CRITICAL

9.8

CVE-2026-2634 CRITICAL

9.8

CVE-2025-68277 MEDIUM POC

5.0

CVE-2026-11175 HIGH

8.8

CVE-2026-53829 HIGH

8.5

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Package Hub 15 SP7	Fixed
openSUSE Leap 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP7	Affected

CVE-2026-11172 vulnerability details – vuln.today

Back

Google Chrome CVE-2026-11172

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More in Chrome

Same weakness CWE-451 – User Interface (UI) Misrepresentation of Critical Information

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code