Chrome Android CVE-2026-11291

Exploitation requires the victim to be running Google Chrome on an Android device (not desktop Chrome or other platforms) with Android Autofill active, which is the default configuration on most Android deployments. The CVSS vector confirms PR:N - no authentication is needed from the attacker - but UI:R is required, meaning the victim must actively navigate to or interact with the attacker-controlled HTML page; drive-by exploitation without any user click or navigation is not possible. The scope is limited to Chrome for Android versions below 149.0.7827.53. Exploitation is further constrained by the impact ceiling of I:L only, meaning even a successful bypass yields no confidentiality disclosure and no availability disruption - limiting attacker utility to cross-origin content manipulation. Defenders should note that enterprise environments with MDM-enforced browsing restrictions or Autofill disabled would not be reachable via this attack path.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, indicating network-reachable exploitation with low attack complexity and no authentication requirement, but mandating user interaction and producing only a limited integrity impact with no scope change. Chromium's own security team independently rated this 'Low', which aligns with the constrained impact vector. EPSS at 0.02% (4th percentile) places this well below the threshold that typically correlates with opportunistic or automated exploitation. No CISA KEV listing exists and no public proof-of-concept has been identified at time of analysis. The combination of required user interaction (UI:R), platform specificity (Android only), Android Autofill dependency, and minimal impact scope (I:L only) significantly reduces real-world risk relative to the base CVSS vector. This is not a high-priority remediation item for most organizations, but Chrome's rapid release cadence makes patching low-cost.

An attacker hosts a crafted HTML page designed to trigger unexpected behavior in Chrome's Android Autofill bridge and lures a victim into visiting that page on a Chrome for Android device - through phishing, malicious advertising, or a compromised link. Upon page load and Autofill interaction, the same-origin policy check is bypassed, enabling the attacker to perform limited cross-origin write operations against content from a different origin. No public proof-of-concept code has been identified at time of analysis, and the low EPSS score suggests this scenario has not been reliably reproduced by the broader threat actor community.