CVE-2026-11291: Android Chrome Autofill Same-Origin Policy Bypass

Technical summary

CVE-2026-11291 stems from an inappropriate implementation in the Android Autofill subsystem of Google Chrome. The vulnerability enables circumvention of the same-origin policy (SOP)—a fundamental browser security boundary that prevents scripts from one domain from accessing data belonging to another domain. The flaw requires a remote attacker to host a crafted HTML page and convince a user to visit it. Once a user interacts with the page, the autofill mechanism can be abused to violate SOP constraints, potentially exposing or modifying autofilled credentials or form data. The vulnerability is classified under CWE-346 (Origin Validation Error), indicating the root cause involves improper verification of origin boundaries in the autofill context.

Business impact

The primary business risk centers on credential exposure and unauthorized form manipulation. If an attacker successfully exploits this vulnerability, users' saved passwords, credit card information, or other autofilled data could be exposed or manipulated without their knowledge. Organizations relying on Chrome as a standard browser on Android devices face a credential theft risk, particularly for employees who reuse passwords across corporate and personal services. While the attack requires user interaction and the scope is limited to autofill contexts, the erosion of SOP protections is strategically significant: it weakens one of the core browser security models that protects users from phishing and man-in-the-middle attacks. For enterprises managing mobile fleets, this represents a medium-priority remediation task.

Affected systems

Google Chrome on Android devices running versions prior to 149.0.7827.53 are affected. The vulnerability does not impact Chrome on desktop/other platforms. Android users of Chrome are the primary target. Organizations deploying Chrome as a managed browser on corporate Android devices, or employees using Chrome on personal Android phones for work purposes, are in scope.

Exploitability

Exploitation requires an attacker to craft a malicious HTML page and convince a user to visit it—a phishing or watering-hole scenario. No network-based exploitation is possible; the attack is confined to the browser context and depends entirely on user interaction. The vulnerability cannot be exploited silently or remotely without user action. The CVSS vector reflects these constraints: AV:N (network attack surface), AC:L (low complexity once a user visits the page), PR:N (no privileges needed), UI:R (user interaction required), and limited integrity impact. Real-world exploitation is plausible but not trivial, as it requires convincing a user to visit a attacker-controlled page. This is not currently tracked in CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Users and administrators should update Chrome on Android to version 149.0.7827.53 or later. Google has patched the autofill implementation to properly enforce same-origin policy boundaries. Organizations managing Chrome on Android through Mobile Device Management (MDM) should prioritize this update in their deployment schedules. For users on unmanaged devices, the update should be applied as soon as Google Play distribution reaches their device. Because the vulnerability requires user interaction and is not being actively exploited at scale, this is a standard-priority patch rather than an emergency one.

Patch guidance

Verify that affected Chrome installations have been updated to version 149.0.7827.53 or later. On managed Android devices, use your MDM platform to enforce the update and confirm deployment. Users can manually check their Chrome version by navigating to Chrome menu → Settings → About Chrome, which will automatically check for and apply updates. For enterprise deployments, consider setting a 30–60 day remediation window to allow for normal device rotation and user availability. Test autofill functionality after patching to ensure no regression in legitimate form-filling workflows.

Detection guidance

Detection of exploitation attempts is limited to user-reported anomalies or suspicious autofill behavior. Monitor for user reports of unexpected credential leaks or unauthorized account access from Android devices. Organizations can review Chrome browser logs (if available through MDM) for unusual autofill activity, though Chrome's privacy model limits visibility into individual autofill events. Network-based detection is not feasible, as the attack occurs entirely within the browser context. If credential breaches occur following a specific time window and are concentrated among Android Chrome users, investigate whether a phishing campaign exploiting this vulnerability was conducted.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS 4.3 score and requirement for user interaction mean it poses moderate rather than critical risk. However, the nature of the flaw—a SOP bypass affecting credential autofill—makes it strategically important to patch before attackers develop and distribute weaponized phishing campaigns. The absence of KEV status and active exploitation indicates the threat landscape has not yet mobilized around this CVE, creating a window of opportunity to deploy patches proactively.

Risk score, explained

The CVSS 4.3 (Medium) score reflects a network-accessible vulnerability with low attack complexity and moderate integrity impact, tempered by the requirement for user interaction and limited scope. While Chromium's internal assessment rated it as Low severity, the CVSS calculation appropriately emphasizes the SOP bypass as a meaningful security boundary violation. For organizations, the practical risk depends on the prevalence of Chrome on Android in your environment and the sophistication of your users' security awareness—phishing-prone user populations elevate the real-world risk.

Frequently asked questions