CVE-2026-11108: Inappropriate implementation in NFC in Google Chrome on Android prior to 149

Synopsis

This is a privilege escalation vulnerability caused by an inappropriate NFC implementation in Google Chrome on Android, affecting versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but the victim must visit a crafted HTML page for the attack to succeed. Successful exploitation gives the attacker elevated privileges within the browser context, with full impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network; the victim's device must be able to reach and load the attacker-controlled HTML page.

• AuthenticationNot required

  No account or credentials on the target system are needed; any user browsing to the crafted page is a valid target.

• Victim interactionRequired

  The victim must actively visit a crafted HTML page, making this a social-engineering scenario where the attacker must lure the user to a malicious URL.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental preconditions.

Blast Radius

• A successful attacker gains escalated privileges within the Chrome browser process on the victim's Android device.
• With elevated privileges, the attacker can read sensitive data accessible to the browser, including stored credentials, session tokens, and browsing history.
• The attacker can modify browser state or data, including saved form data and browser storage.
• The attacker can crash or destabilize the Chrome process, disrupting the victim's browsing session.