CVE-2026-11178: Chrome WebView Cross-Origin Data Leak on Android – Patch Guidance

Technical summary

CVE-2026-11178 exploits insufficient policy enforcement within WebView, the embedded browser component used by Chrome on Android. The vulnerability stems from a cross-origin policy bypass (CWE-346) that permits a remote attacker to exfiltrate data across origin boundaries via a crafted HTML page. The attack vector is network-based with low complexity; the user must engage with the malicious content (e.g., click a link or visit a page), but no authentication or special Android privileges are required. The Chromium security team classified this as Medium severity due to limited confidentiality impact and the requirement for user interaction.

Business impact

For organizations with users accessing corporate resources through Chrome on Android devices, this vulnerability presents a data confidentiality risk. If an employee visits a malicious website while using a work or personal device to access company web applications, an attacker could potentially steal session tokens, authentication credentials, or sensitive business data cached in the browser. The risk is particularly acute in bring-your-own-device (BYOD) environments and for organizations relying on web-based SaaS platforms. However, the requirement for active user interaction and the Medium CVSS score mean this is not an immediate, system-wide compromise vector.

Affected systems

Google Chrome on Android devices running version 149.0.7827.52 and earlier are vulnerable. WebView is a core component embedded in Chrome and used by many third-party Android applications, so the reach extends beyond standalone Chrome usage. Users on tablets and smartphones are at risk. Desktop Chrome versions are unaffected. Organizations should verify which Android versions and Chrome releases are in use across their device fleet.

Exploitability

Exploitation requires a user to visit a malicious website or click a crafted link. The attack does not require the victim to install additional software, grant unusual permissions, or compromise their device. Social engineering, phishing emails, or advertisement networks could deliver the payload. No known public exploits have been listed in CISA's Known Exploited Vulnerabilities catalog as of the last update, and Chromium's Medium classification reflects that the attack surface, while real, is constrained by the need for user interaction and limited to confidentiality impact.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. Users should enable automatic updates in the Google Play Store settings. Organizations managing Android devices via Mobile Device Management (MDM) solutions should push the Chrome update through their management console. Additionally, educate users to avoid clicking suspicious links and to be cautious when visiting unfamiliar websites, particularly those offering unexpected or unsolicited content.

Patch guidance

Check the Google Chrome version installed on Android devices via Settings > About Chrome; the system will indicate whether updates are available and can initiate installation immediately. For enterprise environments, verify that device management policies allow Chrome auto-updates or manually deploy the update via your MDM platform. Confirm that the installed version displays 149.0.7827.53 or higher. Third-party applications that bundle WebView should also be checked, as some may have independent update cycles; consult their respective app stores or vendor advisories.

Detection guidance

Network and endpoint monitors should track Chrome version distributions across Android devices to identify stragglers. On-device telemetry from MDM solutions can flag devices with Chrome versions prior to 149.0.7827.53. Web traffic analysis may reveal suspicious HTML payloads or unusual cross-origin data requests, though this is challenging given the volume of legitimate browser activity. Phishing and email security controls should be tuned to detect links to known malicious domains or spoofed internal sites that might serve as attack platforms. Monitor for unusual data exfiltration from web sessions.

Why prioritize this

While the CVSS score of 4.3 reflects a Medium-severity vulnerability, organizations should prioritize patching because Chrome on Android is ubiquitous, WebView is embedded in numerous third-party applications, and mobile devices often store cached credentials and session tokens. The exploit requires only user interaction, which is a common attack vector. The lack of KEV status indicates no widespread active exploitation has been publicly reported, affording a window to patch before attackers weaponize this vulnerability at scale. Mobile device security is frequently a weak point in enterprise defense; this patch is relatively low-friction to deploy.

Risk score, explained

The CVSS v3.1 score of 4.3 (Medium) reflects a network-accessible vulnerability requiring user interaction with low attack complexity. The impact is strictly confidentiality (data leak); there is no integrity or availability component. The scope is unchanged (impact is confined to the user's security context). The score appropriately reflects that the attack is feasible but not trivial, and that damage is limited to information disclosure rather than system compromise or data modification.

Frequently asked questions