Chrome Android CVE-2026-11270

Exploitation requires the victim to be running Google Chrome on Android at a version prior to 149.0.7827.53 and to visit a crafted HTML page controlled by the attacker - user interaction is confirmed required by CVSS UI:R. The vulnerability is explicitly scoped to Android and does not affect Chrome on other platforms based on available data. No privileges are required from the attacker (PR:N per CVSS), but the victim's browser must load the malicious page. Exploitation is limited by: mandatory victim-side navigation to the attacker's page, the Android-only platform scope, and the impact being confined to confidentiality - no code execution or data modification is enabled. These limiting factors substantially reduce realistic risk below what the C:H CVSS sub-score alone implies.

The CVSS 6.5 medium score is driven by high confidentiality impact (C:H) and zero-friction access conditions (AV:N/AC:L/PR:N), but is substantively tempered by mandatory user interaction (UI:R) and the complete absence of integrity or availability impact (I:N/A:N). Against these CVSS signals, the EPSS score of 0.03% at the 11th percentile strongly indicates this vulnerability has not attracted exploitation tooling or attacker interest. There is no CISA KEV listing and no publicly available exploit code identified at time of analysis. Chromium's own 'Low' internal severity rating further corroborates limited practical impact. The gap between CVSS 6.5 and the low EPSS/Chromium severity is consistent with the combination of Android-only scope, required user interaction, and a narrow data-disclosure impact. This does not warrant emergency response - standard patch cycle prioritization is appropriate for most environments.

An attacker hosts a specially crafted HTML page on an attacker-controlled server and delivers the URL to a target via phishing, malvertising, or a messaging platform. When a victim on an Android device visits the page in a vulnerable Chrome version, the page exploits the UI implementation flaw to issue cross-origin requests and extract data from a co-visited or authenticated origin, exfiltrating it back to the attacker. No public exploit code exists at time of analysis, and the low EPSS score suggests this scenario has not been operationalized in the wild.