CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149

Synopsis

This is an insufficient input validation vulnerability in the Drag and Drop component of Google Chrome on Android, affecting versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, though it does require the attacker to have already compromised the renderer process and to trick the victim into interacting with a crafted HTML page. Successful exploitation enables a sandbox escape, giving the attacker the ability to read sensitive data, tamper with content, and disrupt service outside the browser sandbox. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the crafted HTML page over the network, so the target device must be reachable by or must browse to attacker-controlled content.

• AuthenticationNot required

  No account or credentials are needed; the attack is launched from an unauthenticated remote position against any user who visits the crafted page.

• Victim interactionRequired

  The victim must interact with a crafted HTML page, such as performing a drag-and-drop action, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is high because the attacker must have already compromised the renderer process as a precondition before the sandbox escape can be triggered.

Blast Radius

• A successful sandbox escape lets the attacker read data outside the Chrome sandbox, including stored credentials, session tokens, and files accessible to the browser process on the Android device.
• The attacker gains the ability to write or modify data outside the sandbox, including application storage or system-accessible files depending on device permissions.
• The attacker can crash or destabilize processes outside the browser sandbox, causing service disruption beyond the tab or browser instance.
• Because the scope change is confirmed (S:C in the CVSS vector), impact extends beyond the compromised browser context to other components on the same device.