CVE-2026-11097: Chrome Android WebView Cross-Origin Data Leak Vulnerability

Technical summary

CVE-2026-11097 is a cross-origin data leak vulnerability in Chrome's WebView on Android, rooted in improper handling of same-origin policy enforcement. The WebView implementation fails to adequately isolate data between origin contexts, allowing a remote attacker to exfiltrate sensitive information via a crafted HTML page. The underlying issue is catalogued as CWE-474 (Inappropriate Implementation), indicating a design or logic flaw rather than a classic memory corruption or input validation error. The attack vector is network-based with low complexity and requires user interaction but no special privileges.

Business impact

For organizations managing Android devices that run Chrome or apps embedding Chrome WebView, this vulnerability poses a confidentiality risk. Users' authenticated session data, personal information, or internal web application data visible in the browser could be accessed by attackers if users visit malicious sites. The impact is heightened in Bring Your Own Device (BYOD) environments and for users accessing corporate web applications or cloud services through mobile browsers. Data breaches resulting from this flaw could expose customer PII, trade secrets, or intellectual property.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.53 are affected. Any Android application that embeds Chrome WebView is also vulnerable unless it is updated. This includes the default Chrome browser and third-party apps using the WebView component. Desktop and iOS versions of Chrome are not affected by this specific vulnerability.

Exploitability

The vulnerability has a CVSS score of 6.5 (Medium severity) and is not currently listed on the CISA Known Exploited Vulnerabilities catalog, indicating no widespread active exploitation has been publicly disclosed. However, exploitation requires only a network connection and user interaction—an attacker simply needs to trick a user into visiting a malicious webpage. No complex attack setup, zero-day techniques, or privileged access is required, making it exploitable by attackers with moderate resources once exploitation techniques become public.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. This patch corrects the WebView implementation to properly enforce cross-origin isolation. For enterprise users, ensure that mobile device management (MDM) policies enforce automatic updates or mandate manual updates within a reasonable timeframe. Apps that embed WebView should also be updated if patches are available from their vendors.

Patch guidance

Apply Chrome updates through Google Play Store, which typically delivers updates automatically. Android users should navigate to Chrome settings > About Chrome to check the current version and trigger an automatic update check if needed. Enterprises using MDM solutions (Intune, MobileIron, Jamf, etc.) should configure policies to deploy Chrome version 149.0.7827.53 or later to managed Android devices. Verify patch deployment by confirming device Chrome versions align with the fixed release.

Detection guidance

Monitor for Chrome version compliance across your Android device fleet using MDM reporting tools. Look for Chrome versions older than 149.0.7827.53 and prioritize devices that cannot be automatically updated. On the network level, detect potential exploitation attempts by monitoring for unusual cross-origin requests or data exfiltration patterns in web traffic from mobile devices, though signature-based detection is limited without application-level telemetry. Consider deploying endpoint detection and response (EDR) solutions on Android where feasible to flag suspicious WebView activity.

Why prioritize this

This vulnerability merits prioritization for organizations with significant Android user bases or BYOD programs. Although the CVSS score is Medium and exploit code is not yet public, the low attack complexity and user interaction requirement make it a practical target for opportunistic attackers. The confidentiality impact (data leakage) directly threatens sensitive business information. Prioritize patching devices used by employees accessing internal web applications, customer data, or financial systems.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects a network-accessible vulnerability with high confidentiality impact but no integrity or availability consequences. The requirement for user interaction (clicking a malicious link) reduces the score below 7.0, placing it in the Medium category. The score appropriately captures the real-world risk: while not as severe as remote code execution flaws, the ease of exploitation and sensitivity of data at risk warrant urgent patching.

Frequently asked questions