CVE-2026-11172: Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149

Synopsis

A UI spoofing vulnerability exists in the Contact Picker component of Google Chrome on Android, affecting versions prior to 149.0.7827.53. The flaw is reachable over the network without any authentication, but requires the victim to interact with a crafted HTML page delivered by the attacker. Successful exploitation lets an attacker spoof security UI elements, deceiving the user into granting contact access or taking other actions under false pretenses, with high impact to confidentiality, integrity, and availability. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver a crafted HTML page to the victim over the network, requiring the target device to be reachable via a browser session.

• AuthenticationNot required

  No account or credentials are needed; any unauthenticated remote attacker can serve the malicious page.

• Victim interactionRequired

  The victim must visit or be redirected to the attacker-controlled HTML page, making social engineering or malicious ad delivery the primary delivery mechanism.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental prerequisites required beyond victim interaction.

Blast Radius

• Attacker spoofs Chrome security UI around the Contact Picker, tricking the victim into believing a legitimate permission dialog is being shown.
• Victim is manipulated into granting contact access or confirming actions they would otherwise reject, exposing stored contact data.
• Attacker can modify the perceived state of security indicators, enabling follow-on phishing or credential harvesting within the browser context.
• The scope of impact covers confidentiality, integrity, and availability of the affected browsing session and exposed contact information.