CVE-2026-11175: Incorrect security UI in Messages in Google Chrome on Android prior to 149

Synopsis

UI spoofing vulnerability in Google Chrome for Android (Messages component) allows a remote attacker to present a forged security interface to victims via a crafted HTML page. Exploitation requires no authentication but does require the victim to visit or interact with a malicious page; the attack is reachable over the network. Successful exploitation gives the attacker high confidentiality, integrity, and availability impact, enabling credential theft, data tampering, or service disruption through the spoofed interface. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must deliver the crafted HTML page to the victim over the network, so the vulnerable Chrome instance must be reachable or browsing to an attacker-controlled origin.

• AuthenticationNot required

  No account or credential is needed; the attacker requires no prior authentication to the target.

• Victim interactionRequired

  The victim must visit or otherwise interact with a crafted HTML page, making social engineering a prerequisite for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• A successful attacker reads sensitive data accessible within the Chrome Messages context, such as stored messages or session tokens.
• The attacker can modify or inject data within the spoofed UI, causing the victim to submit credentials or approve actions under a forged interface.
• The attack can disrupt availability of the Chrome Messages component, degrading or crashing the affected service on the victim device.
• All three impact dimensions (confidentiality, integrity, availability) are rated high, so the attacker gains broad control over the data and function exposed through the vulnerable component.