Inappropriate implementation in Payments in Google Chrome on Android prior to 149

CVE-2026-11148 is a Chrome for Android Payments bug that can expose cross-origin data before version 149.0.7827.53. The public record says it is a *local attacker* issue triggered with a crafted HTML page, which matters: this is not a server bug and not a one-packet internet exploit. The affected population is Android Chrome clients below 149.0.7827.53, with impact limited to confidentiality rather than code execution, persistence, or sandbox escape.

The vendor's 6.5/MEDIUM is defensible in a vacuum, but it still overstates the operational urgency for a 10,000-host enterprise patch queue. The attack path is constrained by platform scope (Android only), client-side reachability, required user interaction, and the unusually important prerequisite implied by *local attacker* in the CNA text. That combination pushes this down from 'patch now' to 'patch in normal mobile/browser hygiene,' unless you have a high-risk Android fleet handling sensitive payments or regulated browser sessions.

Why this verdict

• Local-attacker wording cuts hard against urgency — the CNA description itself says *local attacker*, which implies the adversary is already on the handset or has another on-device execution path.
• Android-only client population is narrower — this is not Chrome across all platforms and not a shared server component; only Android Chrome clients below 149.0.7827.53 are in scope.
• Impact is confidentiality-only — no code execution, no sandbox escape, no persistence, and no availability hit are documented.
• User interaction is still required — the victim must open or engage with crafted content, which reduces automation and mass-exploitation value.
• Threat intel is cold — no KEV entry, no public exploitation evidence, no public PoC, and an extremely low EPSS all argue against near-term attacker demand.

Why not higher?

It does not clear the bar for MEDIUM-or-higher operational urgency because the reachable population is constrained and the attack does not produce device takeover. If this were unauthenticated remote, cross-platform, or paired with public exploitation evidence, the score would climb fast.

Why not lower?

It is still a real same-origin boundary failure in a widely deployed browser, and confidentiality impact can matter if the user is sitting on authenticated sessions. Browser bugs also age poorly once root cause diffing becomes easier after broad patch adoption.

1. Block unmanaged Android app installs — Reduce the most plausible precursor: a malicious local app that can drive vulnerable Chrome into attacker-controlled content. Enforce via MDM/UEM allowlisting and Play Protect policy; for a LOW verdict there is no mitigation SLA, so treat this as backlog hygiene and fold it into your normal mobile hardening baseline.
2. Force Chrome auto-update on managed Android — Use enterprise mobility management to pin Chrome to auto-update from managed Play and close version lag on mobile browsers. For a LOW verdict there is no mitigation SLA and no separate urgent workaround requirement; keep it in routine browser maintenance.
3. Constrain risky browsing contexts on mobile — For high-sensitivity user groups, route mobile browsing through managed work profiles, conditional access, and sanctioned app lists so a local malicious app has less room to stage the trigger. Again, for LOW this is normal-risk reduction, not an emergency change window.

Run this on an auditor workstation with adb installed and USB debugging or enterprise shell access to the Android device. Invoke it as ./check_chrome_android_cve_2026_11148.sh SERIAL (example: ./check_chrome_android_cve_2026_11148.sh emulator-5554). No root is required, but you need permission to query package metadata on the target device.

#!/usr/bin/env bash
# check_chrome_android_cve_2026_11148.sh
# Checks whether Google Chrome on an attached Android device is below 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/dependency error

set -u

FIXED_VERSION="149.0.7827.53"
PACKAGE="com.android.chrome"

usage() {
  echo "Usage: $0 <adb-serial>"
  exit 3
}

if [ $# -ne 1 ]; then
  usage
fi

SERIAL="$1"

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN - adb not found in PATH"
  exit 3
fi

adb -s "$SERIAL" get-state >/dev/null 2>&1
if [ $? -ne 0 ]; then
  echo "UNKNOWN - device not reachable via adb: $SERIAL"
  exit 2
fi

VERSION_LINE=$(adb -s "$SERIAL" shell dumpsys package "$PACKAGE" 2>/dev/null | tr -d '\r' | grep -m1 'versionName=')
if [ -z "$VERSION_LINE" ]; then
  echo "UNKNOWN - could not read Chrome package metadata (package missing or restricted)"
  exit 2
fi

INSTALLED_VERSION=${VERSION_LINE#*=}
INSTALLED_VERSION=$(echo "$INSTALLED_VERSION" | awk '{print $1}')

normalize_version() {
  local ver="$1"
  local IFS='.'
  local parts
  read -r -a parts <<< "$ver"
  while [ ${#parts[@]} -lt 4 ]; do
    parts+=(0)
  done
  printf "%d %d %d %d\n" "${parts[0]}" "${parts[1]}" "${parts[2]}" "${parts[3]}"
}

compare_versions() {
  # returns 0 if equal, 1 if first > second, 2 if first < second
  local a b i
  read -r -a a <<< "$(normalize_version "$1")"
  read -r -a b <<< "$(normalize_version "$2")"
  for i in 0 1 2 3; do
    if [ "${a[$i]}" -gt "${b[$i]}" ]; then
      return 1
    fi
    if [ "${a[$i]}" -lt "${b[$i]}" ]; then
      return 2
    fi
  done
  return 0
}

compare_versions "$INSTALLED_VERSION" "$FIXED_VERSION"
CMP=$?

if [ $CMP -eq 2 ]; then
  echo "VULNERABLE - Chrome $INSTALLED_VERSION < $FIXED_VERSION on device $SERIAL"
  exit 1
elif [ $CMP -eq 0 ] || [ $CMP -eq 1 ]; then
  echo "PATCHED - Chrome $INSTALLED_VERSION >= $FIXED_VERSION on device $SERIAL"
  exit 0
else
  echo "UNKNOWN - version comparison failed for $INSTALLED_VERSION"
  exit 2
fi

Sources

1. NVD CVE-2026-11148
2. Chrome Releases: Stable Channel Update for Desktop (Chrome 149)
3. Chrome Releases: Early Stable Update for Desktop
4. Chrome Releases: Chrome for Android Update
5. Chromium issue 501738451
6. Vulnerability-Lookup entry for CVE-2026-11148
7. CISA Known Exploited Vulnerabilities Catalog
8. FIRST EPSS API documentation