CVE-2026-11295: Inappropriate implementation in WebView in Google Chrome on Android prior to 149

Synopsis

This is a privilege escalation vulnerability in the WebView component of Google Chrome on Android, affecting all versions prior to 149.0.7827.53. The flaw is reachable over the network and requires no authentication, but does require the victim to visit a crafted HTML page. Successful exploitation gives the attacker high-impact access to confidentiality, integrity, and availability on the affected device. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the exploit over the network by luring the victim to a remotely hosted crafted HTML page, so the vulnerable service must be reachable from the internet or an accessible network.

• AuthenticationNot required

  No account credentials or prior authentication are needed; any anonymous remote attacker can attempt the exploit.

• Victim interactionRequired

  The victim must visit a crafted HTML page, meaning the attacker depends on a social-engineering step such as a phishing link or malicious redirect.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other hard-to-control environmental factors.

Blast Radius

• A successful attacker reads sensitive data stored or accessible through the WebView context, including cookies, session tokens, and local application data.
• The attacker writes or modifies application data and on-device storage accessible to the Chrome or WebView process.
• The attacker can crash or destabilize the affected Chrome or WebView process, disrupting the application relying on it.
• Because this is a privilege escalation, the attacker may gain capabilities beyond the normal WebView sandbox, potentially affecting other resources on the Android device.