Google Chrome CVE-2026-11287

Exploitation requires two concrete prerequisites: (1) the attacker must have already compromised the Chrome renderer process through a separate vulnerability - this is an explicit prerequisite stated in the description, not an inferred condition; and (2) user interaction is required (UI:R per CVSS vector), meaning the target user must visit or interact with a crafted HTML page. The vulnerability is further scoped to the Android platform of Chrome only, and affects versions prior to 149.0.7827.53. Exploitation is therefore limited to devices running Android with an unpatched Chrome version, and requires chaining with a renderer compromise - a non-trivial barrier that significantly limits opportunistic exploitation. The CVSS PR:N designation conflicts with the renderer pre-compromise requirement described in the CVE; defenders should treat the effective privilege bar as higher than PR:N implies.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) presents a notable inconsistency with the vulnerability description that must be flagged: PR:N indicates no prior privileges are required, yet the description explicitly states exploitation requires a pre-compromised renderer process - a significant prerequisite that substantially raises the effective attack complexity beyond what AC:L implies. This discrepancy means raw CVSS likely overstates standalone exploitability. EPSS at 0.02% (6th percentile) aligns with the constrained exploitation conditions; the vulnerability is not in CISA KEV, and no POC exists at time of analysis. The real-world risk is best understood as a privilege escalation or sandbox escape enabler within a multi-stage attack chain, not a direct initial access vector. The Chromium team's own severity rating of 'Low' is consistent with this assessment. Defenders should prioritize patching for users on Android Chrome given the integrity impact, but this is not an emergency response priority absent evidence of active chaining.

An attacker who has separately exploited a renderer-level vulnerability in Chrome on Android - such as a memory corruption bug - gains code execution within the sandboxed renderer process. From this position, the attacker delivers a crafted HTML page that triggers the insufficient navigation policy enforcement to navigate to restricted URLs, internal pages, or cross-origin targets that the browser should block, enabling further exploitation or data access. No POC for this specific vulnerability has been publicly identified at time of analysis.