CVE-2026-11127: Domain Spoofing in Chrome Android WebAPKs – Patch Guide

Technical summary

CVE-2026-11127 stems from an inappropriate implementation in the WebAPK subsystem of Chromium (Google Chrome's engine). WebAPKs enable developers to package web applications as installable Android apps that run with app-like integration. The vulnerability allows a remote attacker to perform domain spoofing—displaying a different domain to the user than the one actually being loaded—through a crafted WebAPK. The root cause maps to CWE-358 (Improperly Implemented Security-Relevant State Management), suggesting the application fails to properly track or enforce the security context of the displayed domain. The attack requires network access and user interaction (installing the WebAPK), but no privileges.

Business impact

For organizations and enterprises, this vulnerability poses a moderate but real risk to employees using Chrome on Android devices. A well-crafted phishing campaign could distribute a malicious WebAPK disguised as a legitimate company app, then display spoofed internal or partner domains to harvest credentials or trick users into authorizing actions. Mobile-first or BYOD environments face heightened exposure. Financial institutions, SaaS providers, and any organization where users authenticate via mobile Chrome should prioritize this patch to prevent credential theft and account compromise linked to domain spoofing.

Affected systems

The vulnerability affects Google Chrome on Android devices running version 149.0.7827.52 and earlier. While the description references Chrome specifically, the underlying engine is Chromium, so other Chromium-based browsers on Android (such as Edge, Opera, or Samsung Internet, depending on their update cadence) may be similarly affected—verify with those vendors. Desktop Chrome is not affected. The vulnerability requires a user to install and interact with a malicious or compromised WebAPK, so attack surface depends on distribution and user trust in app sources.

Exploitability

Exploitation is moderately straightforward but not trivial. An attacker must first craft a malicious WebAPK, then convince users to install it—either through deceptive distribution (app store impersonation, phishing links, or social engineering) or by compromising a legitimate app developer's build pipeline. Once installed, the spoofing occurs at runtime without further user action. The CVSS score (6.5) reflects this: network-accessible, low complexity, but requires user interaction (installing the app). The flaw is not in the wild per CISA KEV data, but the attack pattern aligns with established phishing and credential-harvesting campaigns.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. Google has released patches addressing this WebAPK handling flaw. For organizations managing Android devices via MDM (Mobile Device Management), enforce a minimum Chrome version policy. Additionally, educate users to install apps only from the official Google Play Store and to verify app publisher identity before installation. Monitor for suspicious WebAPK installations or app-store listings impersonating internal tools.

Patch guidance

Google has addressed this vulnerability in Chrome 149.0.7827.53. Verify patch availability and deployment through Google's official Chrome release notes and your organization's update channels. For managed Android environments, use MDM policies to enforce automatic or staged updates. Test patched Chrome versions in a pilot group before broad deployment to ensure compatibility with line-of-business apps and internal web applications. Update timelines: treat this as a standard-priority patch; enterprises should aim to deploy within 30 days but may prioritize faster if mobile access to sensitive systems is prevalent.

Detection guidance

Monitor Android device logs and MDM telemetry for Chrome versions below 149.0.7827.53. Watch for unusual WebAPK installations—particularly those not distributed through Google Play Store or from untrusted sources. Use security awareness simulations to test how employees respond to suspicious app installation prompts. If available, enable Chrome Enterprise device policy logging to flag version mismatches. Incident response should include reviewing user authentication logs for activity shortly after installing unfamiliar WebAPKs, as this pattern may indicate successful credential theft via spoofed domains.

Why prioritize this

While CVSS 6.5 ranks this as medium severity, the integrity impact (I:H in the vector) reflects genuine harm: domain spoofing directly undermines user trust in web identity and enables phishing-based credential theft. The requirement for app installation raises the bar above simple network exploits, but the ease of social engineering app distribution—especially in less-security-aware user populations—warrants prompt patching. Prioritize this for users in finance, healthcare, or other high-value credential targets.

Risk score, explained

CVSS 3.1 score of 6.5 is driven by: network-accessible attack vector (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and high integrity impact (I:H—the user sees a false domain). Confidentiality and availability are unaffected. User interaction is required (UI:R), which moderates the score. The scope is unchanged (S:U). For organizations, adjust this score upward if mobile Chrome is critical to authentication workflows or if your user base is frequently targeted by phishing. Adjust downward if Chrome on Android is heavily restricted or if authentication is enforced via alternative channels (e.g., hardware tokens, push notifications).

Frequently asked questions