CVE-2026-11035: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149

Synopsis

A privilege escalation vulnerability exists in the Custom Tabs implementation in Google Chrome on Android prior to version 149.0.7827.53. An attacker with an existing low-privilege account on the device can trigger the flaw locally by convincing a user to interact with a crafted XML file, escalating their privileges on the affected system. Successful exploitation gives the attacker full read, write, and execution capability at an elevated privilege level. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationRequired

  Any low-privilege local account on the device is sufficient to attempt this exploit.

• Victim interactionRequired

  The victim must interact with a crafted XML file, requiring some degree of social engineering to deliver and trigger.

• Attack complexityDetail

  The exploit is reliable and condition-free once the attacker has local access and the victim interaction occurs; no race conditions or special environmental factors are required.

Blast Radius

• A successful attacker gains elevated privileges beyond their original low-privilege account, enabling actions that would otherwise be restricted by Android's permission model.
• Confidential data stored on the device, including app data and credentials accessible at the escalated privilege level, is exposed to the attacker.
• The attacker can modify files, settings, or application data that are writable at the escalated privilege level, including persistent storage.
• The attacker can disrupt or terminate processes and services that are controllable at the escalated privilege level, affecting device stability.