Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149

CVE-2026-11029 is an *improper input validation* issue in Chrome's Drag and Drop handling on Android, affecting versions prior to 149.0.7827.53. In plain terms, Chrome is accepting drag-and-drop input it should scrutinize harder, which creates an opportunity for a malicious web page to abuse that gesture path when a user interacts with attacker-controlled content.

Because there is no vendor CVSS or vendor severity, this needs a fresh assessment. The real-world risk lands at MEDIUM, not because browsers are unimportant, but because the attack chain is narrowed by three hard frictions: Android-only reach, likely required user interaction, and a client-side blast radius rather than unauthenticated server-side compromise. Low EPSS and no KEV/exploitation evidence keep this out of the emergency lane.

Why this verdict

• ASSESSED AT MEDIUM because user interaction is the choke point: the attack appears to require a drag-and-drop flow, which is a much less dependable trigger than a pure drive-by page load.
• Android-only narrows the exposed population: this is not all Chrome users, and it is not an exposed enterprise service reachable at scale from the internet.
• No exploit pressure signals: EPSS is extremely low, there is no KEV entry, and I found no public PoC or campaign tying attackers to this bug right now.

Why not higher?

I am not taking this to HIGH because the public facts do not show server-side reach, unauthenticated code execution, sandbox escape, or active exploitation. The combination of Android-only scope and likely drag/drop interaction requirement compounds downward pressure in real fleets.

Why not lower?

I am not dropping this to LOW because Chrome on Android is still a widely deployed user platform, and browser bugs can become meaningful when chained with phishing or identity abuse. Even with heavy friction, improper validation in a browser input path deserves patching attention, not backlog oblivion.

1. Enforce Chrome auto-update on managed Android — Use your EMM/MDM and managed Google Play controls to push or require current Chrome builds. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this control reduces dwell time immediately without waiting for a manual user update.
2. Prefer work-profile data boundaries — If your Android enterprise posture supports it, restrict drag/share flows between personal and work contexts so a malicious browsing session has less chance to touch sensitive enterprise data. This is a sensible containment move while you patch, even though there is no noisgate mitigation SLA for MEDIUM.
3. Alert on stale Chrome versions in mobile inventory — Create an EMM compliance rule for Chrome versions below 149.0.7827.53 and surface noncompliant devices to the mobility team. For MEDIUM, run this through normal operations and finish full remediation within the 365-day window.
4. Harden mobile phishing controls — Since the first step is a malicious page lure, improve URL filtering, SMS/email phishing defenses, and identity telemetry correlation for mobile-origin sessions. This is not a substitute for patching, but it does cut the most realistic initial delivery path during the remediation window.

Run this on an auditor workstation with adb installed, or in CI against a fleet export of Chrome versions. Example: python3 check_chrome_android_cve_2026_11029.py --adb for a connected device, or python3 check_chrome_android_cve_2026_11029.py --version 149.0.7827.48. No root is required; ADB must be authorized on the device if you use --adb.

#!/usr/bin/env python3
# check_chrome_android_cve_2026_11029.py
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / error

import argparse
import re
import subprocess
import sys

PATCHED = (149, 0, 7827, 53)
PKG = "com.android.chrome"


def parse_version(v):
    m = re.match(r'^(\d+)\.(\d+)\.(\d+)\.(\d+)$', v.strip())
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_version(a, b):
    return (a > b) - (a < b)


def get_version_from_adb(serial=None):
    cmd = ["adb"]
    if serial:
        cmd += ["-s", serial]
    cmd += ["shell", "dumpsys", "package", PKG]
    try:
        out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True, timeout=20)
    except Exception as e:
        print(f"UNKNOWN: failed to run adb/dumpsys: {e}")
        sys.exit(2)

    for line in out.splitlines():
        if "versionName=" in line:
            ver = line.split("versionName=", 1)[1].strip()
            return ver
    return None


def main():
    ap = argparse.ArgumentParser(description="Check Chrome on Android for CVE-2026-11029")
    ap.add_argument("--version", help="Chrome version string, e.g. 149.0.7827.48")
    ap.add_argument("--adb", action="store_true", help="Query a connected Android device via adb")
    ap.add_argument("--serial", help="ADB device serial to target")
    args = ap.parse_args()

    version = None

    if args.version:
        version = args.version.strip()
    elif args.adb:
        version = get_version_from_adb(args.serial)
        if not version:
            print("UNKNOWN: could not determine Chrome version from adb output")
            sys.exit(2)
    else:
        print("UNKNOWN: provide --version or --adb")
        sys.exit(2)

    parsed = parse_version(version)
    if not parsed:
        print(f"UNKNOWN: unrecognized version format: {version}")
        sys.exit(2)

    if cmp_version(parsed, PATCHED) >= 0:
        print(f"PATCHED: Chrome {version} is >= 149.0.7827.53")
        sys.exit(0)
    else:
        print(f"VULNERABLE: Chrome {version} is < 149.0.7827.53")
        sys.exit(1)


if __name__ == "__main__":
    main()

Sources

1. Chrome Releases: Chrome for Android Update (149.0.7827.48)
2. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
3. Chrome Releases 2026 archive
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS overview
6. FIRST EPSS API documentation
7. Quanteta CVE tracker entry referencing CVE-2026-11029
8. VulDB CVE listing for CVE-2026-11029