CVE-2026-11226: Chrome Android Same-Origin Policy Bypass – CVSS 6.5

Technical summary

CVE-2026-11226 exploits insufficient policy enforcement within PreviewTab, an Android Chrome feature that likely provides a preview or tab-switching mechanism. The vulnerability stems from a CWE-346 (Origin Validation Error) condition where the browser fails to properly validate the origin of content being previewed or displayed. By crafting specific HTML payloads and relying on user interaction via UI gestures, an attacker can circumvent the same-origin policy (SOP), allowing JavaScript execution or data access across origin boundaries. The vulnerability was patched in Chrome 149.0.7827.53 for Android.

Business impact

This vulnerability creates a targeted phishing and data-theft risk for organizations whose employees use Chrome on Android devices. An attacker could steal session cookies, authentication tokens, or sensitive data from banking, email, or SaaS platforms if a user is tricked into visiting a malicious site while authenticated elsewhere. For bring-your-own-device (BYOD) environments, this represents a potential bridge into corporate systems; for mobile-first enterprises, the risk is more direct. The requirement for user interaction (specific gestures) limits widespread exploitation but does not eliminate risk in targeted campaigns.

Affected systems

Google Chrome on Android devices prior to version 149.0.7827.53 is vulnerable. Desktop Chrome and Chrome on iOS are not affected. The vulnerability is specific to the PreviewTab implementation on the Android platform. Organizations should inventory Chrome deployments on Android—both managed (via MDM) and unmanaged (BYOD)—to understand exposure scope.

Exploitability

Exploitation requires two conditions: (1) a crafted HTML page hosted by the attacker, and (2) user interaction in the form of specific UI gestures (e.g., swipe or tap actions within PreviewTab). This is not a zero-interaction or passive vulnerability. An attacker would likely use social engineering, phishing emails, or malicious ads to lure users to the attacker's page. The attack surface is moderate—anyone browsing the web on vulnerable Chrome instances is at risk if they visit a malicious site, but the gesture requirement makes mass, silent exploitation unlikely. The vulnerability has not been flagged for active exploitation in the wild (KEV status: not added).

Remediation

Update Google Chrome on all Android devices to version 149.0.7827.53 or later. For managed environments (MDM/EMM), deploy updates through your mobile device management platform with appropriate staging to minimize disruption. For BYOD environments, notify users and provide clear update instructions; consider blocking or warning users on older Chrome versions via conditional access policies if your organization uses Workspace or other identity platforms. Verify update completion within 2–4 weeks.

Patch guidance

Verify that Chrome on Android has been updated to 149.0.7827.53 or a later stable release. Check version numbers in Chrome Settings > About Chrome, which will auto-update on most Android devices if automatic updates are enabled. For MDM-enrolled devices, confirm deployment through your management console. Given the Low underlying severity and lack of KEV status, standard patch cycles (within 30 days) are acceptable, though critical infrastructure or high-risk sectors should prioritize within 1–2 weeks. Verify that no legacy Android versions (pre-5.0) are still in use, as Chrome support varies by Android version.

Detection guidance

Monitor for unusual cross-origin requests or data exfiltration patterns from Chrome processes, particularly if PreviewTab or preview-related features are in use. Check browser history and network logs for visits to unfamiliar or suspicious domains around the time of suspected compromise. On managed devices, use MDM telemetry to identify Chrome versions still below 149.0.7827.53 and flag for remediation. Look for evidence of session hijacking (unexpected logins, changed passwords) on accounts accessed from vulnerable Chrome instances. Endpoint detection tools should monitor for abnormal data access patterns or credential theft indicators correlated with Chrome process activity.

Why prioritize this

While Chromium's internal rating is Low, the CVSS 6.5 Medium score reflects the integrity impact of same-origin bypass—a fundamental breach of web security. Prioritization should be moderate: patch within 2–4 weeks in most environments, faster (1–2 weeks) if users frequently access sensitive web services (banking, email, corporate apps) on their Android devices, or if BYOD is prevalent. The lack of KEV status and active exploitation reduces urgency, but the nature of the vulnerability (data theft, session hijacking) justifies faster remediation than typical Low-severity issues.

Risk score, explained

The CVSS 6.5 reflects attack vector Network (can be reached over the internet), attack complexity Low (no special conditions needed beyond user interaction), privilege requirement None (unauthenticated attacker), user interaction Required (specific gestures needed), scope Unchanged, confidentiality None (SOP bypass doesn't inherently leak encrypted data without additional payload), integrity High (attacker can modify or access data from other origins), and availability None. The integrity impact is the key driver; an attacker could steal session tokens or modify state, even if they cannot decrypt HTTPS traffic. This is not a critical vulnerability, but it is material enough to warrant measured urgency.

Frequently asked questions