CVE-2026-11297: Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149

Synopsis

Insufficient input validation in the Reader Mode component of Google Chrome for Android allows a local attacker to bypass navigation restrictions via a malicious file. The vulnerability is reachable locally with no authentication or user interaction required, derived from a CVSS:3.1 vector of AV:L/AC:L/PR:N/UI:N. Successful exploitation gives the attacker the ability to tamper with data and disrupt the affected service, without exposing confidential information. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target is required.

• AuthenticationNot required

  No account or credentials are needed; the attacker can proceed without authenticating to the system or application.

• Victim interactionNot required

  The exploit does not rely on any action from a user or victim; the attacker can trigger the vulnerability independently.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no special timing, race conditions, or environmental setup.

Blast Radius

• Attacker modifies application navigation state and persisted data within the Chrome Reader Mode component.
• Attacker crashes or disrupts the Reader Mode service, causing loss of availability for that feature on the affected device.
• No confidential data is exposed; the impact is limited to integrity and availability of the affected component.