CVE-2026-11215: Chrome Android Domain Spoofing Vulnerability

Technical summary

CVE-2026-11215 is an implementation defect in Cronet (Google's HTTP/HTTPS networking library) affecting Chrome on Android prior to version 149.0.7827.53. The vulnerability falls under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), where improper domain validation allows a malicious domain name to be rendered in a way that deceives the user about the actual origin of the content being loaded. The flaw does not allow arbitrary code execution or direct data exfiltration, but undermines the security indicator that users rely on to verify website authenticity.

Business impact

Domain spoofing via UI misrepresentation significantly increases phishing and credential harvesting risk. Users cannot reliably distinguish legitimate from malicious sites on affected Android devices, increasing the likelihood of successful social engineering attacks. Organizations with mobile workforces using Chrome on Android face elevated risk of employee credentials being compromised, especially for cloud services and financial platforms. This is particularly dangerous in bring-your-own-device (BYOD) environments where employee devices lack managed controls.

Affected systems

Google Chrome on Android running versions prior to 149.0.7827.53 are directly affected. The vulnerability is specific to the Android platform; Chrome on desktop and other browsers are not affected by this particular flaw. All Android users running the vulnerable Chrome versions are at risk, regardless of device manufacturer or Android OS version, as the issue resides in Chrome's Cronet library.

Exploitability

The vulnerability has a network attack vector and low complexity, meaning it requires no special network positioning. However, it does require user interaction—the victim must click a malicious link or visit an attacker-controlled website. No exploit code appears to be in active circulation, and the vulnerability is not listed on the KEV catalog, suggesting limited real-world exploitation to date. The barrier to exploitation is low for attackers with basic phishing infrastructure, making widespread abuse likely once users become aware of the attack pattern.

Remediation

Organizations should prioritize updating Google Chrome on all Android devices to version 149.0.7827.53 or later. For managed environments, enforce automatic updates or deploy mobile device management (MDM) policies to push the patch. Users should manually check Settings > About Chrome and install updates immediately. Additionally, security awareness training should emphasize verifying domain names carefully and looking for HTTPS certificate indicators, as this flaw undermines those visual cues.

Patch guidance

Google Chrome on Android should be updated to version 149.0.7827.53 or any subsequent release. Verify the installed version by navigating to Chrome menu > Settings > About Chrome, which will display the current version and automatically check for updates. Enterprise organizations can validate patch deployment through their MDM console or by reviewing device inventory reports. No workarounds exist; patching is the only remediation.

Detection guidance

Detection at the network level is difficult, as the attack relies on UI deception rather than network anomalies. Focus detection efforts on user behavior: monitor for unusual authentication failures from mobile devices, spike in phishing report submissions from mobile users, or clusters of failed logins followed by successful ones (credential stuffing patterns). Application logs may show authentication from unexpected geolocations or user agents. Endpoint detection and response (EDR) solutions on managed Android devices can flag Chrome versions below 149.0.7827.53. User reporting remains the most reliable detection mechanism for phishing attempts leveraging this vulnerability.

Why prioritize this

While the CVSS score is moderate (6.5), the practical impact justifies prompt remediation. Domain spoofing is a foundational attack for phishing and credential theft, which are the most common attack vectors in the real world. The vulnerability affects a ubiquitous application (Chrome) on a widely used platform (Android), creating broad exposure. The requirement for user interaction does not significantly reduce risk in practice, as phishing success rates are consistently high. Organizations should prioritize this patch within their standard update cycle, especially for users with access to sensitive systems.

Risk score, explained

The CVSS 3.1 score of 6.5 (Medium) reflects the integrity impact (high) from successful domain spoofing, balanced against the requirement for user interaction and the lack of confidentiality or availability impact. The score does not fully capture the real-world prevalence of phishing and social engineering attacks, which exploit this type of vulnerability repeatedly and effectively. Security teams should consider raising internal priority above the base CVSS score based on organizational risk tolerance for phishing and credential compromise.

Frequently asked questions