CVE-2026-11295: Chrome Android WebView Privilege Escalation Vulnerability – Patch Now

Technical summary

CVE-2026-11295 stems from an inappropriate implementation in WebView's privilege-handling logic, classified under CWE-269 (Improper Access Control). The vulnerability resides in Chrome versions prior to 149.0.7827.53 on Android. Despite Chromium's initial Low security severity assessment, the CVSS 3.1 score of 8.8 reflects the severity from a practical perspective: the attack vector is network-based, requires no special privileges, involves minimal complexity, but does require user interaction (visiting a malicious page). Successful exploitation results in confidentiality, integrity, and availability impact—the attacker gains unauthorized access to sensitive data, can modify system state, and potentially disrupt device functionality.

Business impact

Organizations deploying Chrome or Android apps using WebView face risk of data exfiltration, unauthorized modifications, and service disruption. For enterprises managing Android devices, this vulnerability could enable attackers to compromise corporate data, circumvent mobile device management (MDM) controls, or pivot to backend systems. The reliance on user interaction (UI:R) slightly reduces attack surface compared to completely automated vectors, but phishing and social engineering can reliably trigger clicks. The gap between Chromium's Low severity rating and CVSS 8.8 suggests the vendor's assessment underestimated real-world impact.

Affected systems

Google Chrome on Android versions before 149.0.7827.53 are directly affected. However, the threat extends to any Android application built with the vulnerable WebView component, including browsers, email clients, in-app browsers, and social media apps. Organizations should inventory all Android apps that embed WebView or bundle Chromium. Android versions themselves are not inherently vulnerable—the issue is in Chrome/WebView; however, Android devices without timely Chrome updates remain exposed.

Exploitability

Exploitation requires crafting a malicious HTML page and delivering it to a target user. No sophisticated tricks are needed—user interaction (viewing or clicking) on the malicious content triggers the vulnerability. This can be achieved via phishing emails, compromised websites, watering hole attacks, or ads. The attack does not require the victim to have special privileges or the attacker to have local access. This moderate barrier to exploitation, combined with the potential for wide distribution, elevates practical risk despite the requirement for user engagement.

Remediation

Update Google Chrome on Android to version 149.0.7827.53 or later. Users should enable automatic updates if available. Organizations should audit their app inventory for WebView usage, ensure apps are kept current, and consider enforcing Chrome updates through MDM policies on managed devices. WebView updates may arrive separately from Chrome in some scenarios, so verify that both the browser and the underlying WebView component are patched.

Patch guidance

Google released version 149.0.7827.53 to address this flaw. Users should prioritize this update as HIGH. Verify the update through Chrome's Settings > About Chrome, which will display the current version and check for updates automatically. Enterprise deployments should test the patch in a staging environment before rolling out broadly, though the risk of regression is low. For apps relying on WebView, verify that the underlying WebView system component (available through Google Play System Update) is also current.

Detection guidance

Monitor for Chrome version numbers below 149.0.7827.53 in your environment via MDM solutions, vulnerability scanning tools, or endpoint detection and response (EDR) platforms. Look for user reports of unexpected permission requests, unusual app behavior, or suspicious data access from Chrome or WebView-dependent applications. Network indicators are limited since the attack occurs in-browser, but monitor for suspicious HTML/JavaScript patterns if proxying web traffic. Endpoint telemetry showing unusual privilege escalations from WebView-based applications warrants investigation.

Why prioritize this

While not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits urgent patching due to its combination of high CVSS score (8.8), ease of exploitation, wide attack surface (all WebView-dependent apps), and the potential for privilege escalation. The discrepancy between Chromium's Low severity and CVSS 8.8 suggests real-world impact may exceed initial assessment. Organizations should treat this as a priority patch cycle item.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects a network-accessible vulnerability requiring no authentication, minimal attack complexity, and user interaction that is realistically achievable via social engineering. The impact triad (Confidentiality:High, Integrity:High, Availability:High) captures the severity of privilege escalation—an attacker can read sensitive files, modify system settings, and disrupt functionality. The score appropriately weighs the user interaction requirement but does not discount the substantial real-world risk posed by WebView's presence in many Android applications.

Frequently asked questions