CVE-2026-11275: Chrome Android Navigation Bypass via Renderer Compromise

Technical summary

CVE-2026-11275 stems from an inappropriate implementation in Chrome's Page Info component on Android. The vulnerability resides in the renderer process security boundary; an attacker with renderer-level code execution can craft HTML content that, when processed, bypasses the browser's navigation restrictions. The flaw is classified under CWE-284 (Improper Access Control) and was assigned Low severity by the Chromium security team, though the CVSS 3.1 scoring (6.5 Medium) reflects the practical impact when combined with renderer compromise. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N indicates network attack feasibility with user interaction required, high integrity impact (unauthorized navigation), and no confidentiality or availability consequences.

Business impact

Organizations relying on Chrome-based mobile workflows face a specific but limited risk. This vulnerability only threatens users whose Chrome renderer process has already been compromised—a prerequisite suggesting prior malware infection or exploitation of a separate Chrome flaw. An attacker leveraging this flaw could redirect users from safe applications or login flows to phishing pages or malicious domains without typical browser safeguards. For enterprise environments using Chrome on managed Android devices, this represents an incremental risk that compounds other browser-level compromises rather than a standalone attack surface.

Affected systems

Google Chrome on Android versions prior to 149.0.7827.53 are affected. Desktop Chrome and Chrome on other platforms are not impacted by this specific flaw. The vulnerability is specific to Android's implementation of the Page Info feature and does not extend to iOS Safari, Firefox, or other browsers. Organizations should verify their deployed Chrome versions across Android endpoints.

Exploitability

Exploitation requires a two-stage attack: first, the attacker must compromise Chrome's renderer process through a separate vulnerability or malware infection; second, they must serve a crafted HTML page to the compromised browser. While the initial compromise is challenging, once achieved, triggering this bypass is straightforward. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited active exploitation in the wild to date. However, the relatively low barrier to exploitation post-compromise warrants timely patching.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. Users should enable automatic Chrome updates in their Android device settings to ensure patches are deployed promptly. For managed enterprise Android deployments, administrators should use Mobile Device Management (MDM) policies to enforce Chrome version pinning or auto-update configurations. No workarounds exist; patching is the only mitigation.

Patch guidance

Patch deployment should prioritize devices running Chrome older than 149.0.7827.53. Most users on auto-update will receive this patch automatically; however, organizations with MDM controls should verify deployment within two weeks of the patch release. The patch is incremental and does not require device restart. For Android Enterprise customers, ensure that Chrome updates are not blocked by organizational policies or custom ROM configurations. Users on older Android OS versions (e.g., Android 8 or earlier) should confirm their device receives the Chrome update, as some older devices may fall out of the Chrome support window.

Detection guidance

Detection is challenging because the exploit runs entirely within the browser renderer process and leaves minimal forensic artifacts. Endpoint Detection and Response (EDR) solutions should monitor for suspicious Chrome child processes spawning unexpected network connections or file operations. Security teams can review Chrome update compliance metrics via MDM consoles to identify devices lagging behind version 149.0.7827.53. Monitor user reports of unexpected page redirects or navigation anomalies in Chrome on Android, which may indicate prior renderer compromise. Web proxies and DNS logging may capture unusual navigation patterns if crafted HTML pages attempt to redirect to known malicious domains.

Why prioritize this

Despite the Medium CVSS score, this vulnerability should not be treated as an emergency. The requirement for prior renderer process compromise significantly limits immediate threat surface. However, it should be patched within standard maintenance windows (1–3 weeks) because: (1) it represents an additional capability for already-compromised browsers, (2) bundling this patch with routine Chrome updates is operationally efficient, and (3) delaying exposes devices to cumulative browser risk. Organizations with high-risk profiles (finance, government, critical infrastructure) managing sensitive user flows on Chrome should prioritize this patch slightly higher.

Risk score, explained

The CVSS 3.1 score of 6.5 Medium reflects the conditional nature of the risk. High integrity impact (I:H) stems from the ability to redirect users against their intent, violating browser security expectations. However, attack vector (AV:N) and attack complexity (AC:L) assume the renderer is already compromised, which significantly constrains the practical attack surface compared to a remote code execution flaw. The lack of confidentiality (C:N) and availability (A:N) impact limits the score further. Organizations should interpret this as 'urgent to patch during the next maintenance cycle' rather than 'drop everything and patch today.'

Frequently asked questions