CVE-2026-11290: Chrome Android Integer Overflow DoS Vulnerability – Patch Guide

Technical summary

CVE-2026-11290 is an integer overflow bug (CWE-190) located in Chrome's WebView implementation on Android. The vulnerability occurs when WebView processes untrusted input without proper bounds checking, allowing numeric values to exceed their intended limits. When an integer overflows, subsequent operations may access invalid memory regions or trigger error conditions. The flaw also involves improper resource validation (CWE-472), meaning the application fails to validate resources before use. Exploitation requires local file system access and user interaction—specifically, the user must open a malicious file through the WebView. Google has assigned this a Low security severity from the Chromium perspective, though the CVSS v3.1 score reflects moderate impact due to the availability impact potential.

Business impact

Organizations deploying Chrome or Chrome-based applications on Android devices face availability risk if users encounter malicious files designed to crash the browser. While the attack is local and non-destructive to data, repeated exploitation could disrupt productivity. The low barrier to user interaction (opening a file) and the broad user base of Android devices mean this could affect organizations with significant mobile device deployments. However, the attack does not enable data theft or system compromise, limiting financial or reputational harm.

Affected systems

Google Chrome on Android prior to version 149.0.7827.53 is affected. This includes any Android device running a vulnerable Chrome version, as well as Android apps that embed Chrome's WebView component (a shared system library used by third-party browsers and apps). Organizations should verify Chrome version numbers on managed Android devices and assess exposure through Chrome usage and WebView embedding in custom applications.

Exploitability

Exploitation requires a local attacker, user interaction, and low privileges. An attacker must convince or socially engineer a user to open a malicious file—this could occur via email attachments, malicious downloads, or compromised websites offering file downloads. The attack is not remotely exploitable and does not require elevated privileges on the device. The requirement for user interaction moderates the risk profile, though user education and file type restrictions can help mitigate exposure. There is no evidence of public exploit code or active exploitation in the wild.

Remediation

Users and administrators should update Google Chrome on Android devices to version 149.0.7827.53 or later. On managed Android deployments, use mobile device management (MDM) solutions to enforce automatic updates or enforce minimum Chrome version policies. For organizations embedding WebView in custom applications, ensure the underlying Android system and any bundled WebView components are patched. End users should also avoid opening files from untrusted sources and consider disabling automatic file downloads in Chrome settings.

Patch guidance

Update Chrome from the Google Play Store or use automated update mechanisms. Verify the installed version through Chrome Settings > About Chrome, which will also check for pending updates. Organizations with managed Android devices should configure MDM policies to require Chrome version 149.0.7827.53 or later. For app developers using WebView, verify that the system WebView component on target devices is current; on Android 10 and later, Chrome/WebView updates are delivered via the Play Store. Test updates in a non-production environment first to ensure compatibility with internal applications and workflows.

Detection guidance

Monitor Chrome crash logs and WebView error reports on managed devices for unexpected crashes linked to file handling. Endpoint detection and response (EDR) solutions on Android should flag suspicious file access patterns or WebView crashes correlated with newly downloaded or opened files. Network-based detection is limited due to the local nature of this vulnerability. Behavioral signals—such as users reporting repeated Chrome crashes after opening files—may indicate exploitation attempts. Review browser history and file access logs for unusual file types or sources preceding crashes.

Why prioritize this

Although the CVSS score is 5.0 (Medium), the actual risk is best considered in organizational context. The vulnerability requires local access and user interaction, limiting spontaneous exploitation. However, Android's widespread use, the ease of social engineering file downloads, and the availability impact (denial of service) warrant prompt patching for organizations with managed mobile devices. The absence of KEV status and low Chromium severity rating suggest this is not an immediate critical threat, but it should be addressed in regular patch cycles within 30–60 days depending on organizational risk appetite and Android device dependency.

Risk score, explained

The CVSS v3.1 score of 5.0 reflects a Medium severity rating. The attack vector is Local (AV:L), requiring the attacker to have local file system access or ability to place a file where the victim can open it. Attack Complexity is Low (AC:L), meaning successful exploitation does not require unusual circumstances. Privileges Required is Low (PR:L), indicating a local user context is sufficient. User Interaction is Required (UI:R), as the victim must open the malicious file. The impact assessment shows no loss of Confidentiality or Integrity (C:N, I:N), but High availability impact (A:H), reflecting the denial of service potential. The Scope is Unchanged (S:U), meaning the impact is limited to the affected component and device. This score appropriately captures a localized but manageable risk.

Frequently asked questions