Inappropriate implementation in WebView in Google Chrome on Android prior to 149

CVE-2026-11167 is an Android-specific Chrome/WebView sandbox-escape condition: on versions prior to 149.0.7827.53, an attacker who has already compromised the renderer process can use a crafted HTML page to try to break into a more privileged browser context. That prerequisite matters more than the scary CVSS label. Affected population is Chrome on Android / Android WebView code before the fix train that landed in the 149.0.7827.x family; Android stable later shipped as 149.0.7827.59 with the same security fixes.

The vendor-side 9.6 CRITICAL score is mathematically correct for a hypothetical remote chain, but operationally inflated for enterprise patch triage because this bug is not initial access. Chrome itself tags it as *Chromium security severity: Medium*, and that lines up better with reality: no KEV entry, no public exploitation evidence, no public PoC, tiny EPSS, and the attacker must first land a separate renderer bug before this CVE even comes into play.

Why this verdict

• Major downgrade for attacker position: exploitation requires a compromised renderer process first. That implies the attacker already burned another browser bug or equivalent compromise step before this CVE matters.
• Population is narrower than desktop Chrome CVEs: this is Android Chrome/WebView, not a generic externally reachable enterprise service. Real exposure depends on your mobile fleet size and update drift, not on internet-facing attack surface.
• Modern controls add friction: Safe Browsing, Chrome hardening, Android sandboxing, SELinux/seccomp, OEM mitigations, and MDM-driven auto-updates all reduce practical weaponization.
• No field evidence: no KEV listing, no public exploitation reporting, and no public PoC materially lower urgency.
• Tiny EPSS supports the downgrade: even if the exact mirrored value varies, the score is in the very low band.

Why not higher?

A higher rating would be justified if this were a one-click initial compromise or if there were active exploitation, KEV listing, or a public exploit chain. None of that is present here. The need for prior renderer compromise is a compounding friction point that CVSS fails to price in.

Why not lower?

This is still a sandbox-escape primitive in one of the most targeted software classes on the planet. If an attacker already has a renderer bug, this kind of CVE can be the difference between a crash and a full chain, so it is not backlog junk.

1. Enforce browser auto-update — Use managed Google Play / MDM policy to require Chrome and Android System WebView auto-updates. For a MEDIUM verdict there is no mitigation SLA; treat this as standard hardening and complete the actual version uplift within the 365-day remediation window.
2. Block stale Android browsers in compliance policy — Create an MDM compliance rule that flags or restricts devices running Chrome/WebView below the fixed train. This reduces long-tail exposure without needing emergency response; for MEDIUM, there is no mitigation SLA — go straight to remediation.
3. Reduce risky browsing contexts — Where your MDM stack supports it, restrict unmanaged sideloaded browsers and keep users on the managed Chrome channel so fixes propagate predictably. This is a normal-risk control improvement to complete alongside remediation within 365 days.
4. Watch for chained-browser activity — Tune MTD/EDR alerts for repeated Chrome/WebView crashes, exploit-style browser instability, and high-risk navigation patterns on corporate Android devices. This does not replace patching, but it gives you a chance to catch the separate renderer-stage bug this CVE depends on.

Run this from an auditor workstation that has adb installed and an authorized Android device connected. Invoke it as ./check_cve_2026_11167.sh SERIAL or ./check_cve_2026_11167.sh for the only attached device; it needs no root, but it does require USB debugging (or equivalent adb) access.

#!/usr/bin/env bash
# check_cve_2026_11167.sh
# Verifies whether connected Android device has Chrome / Android System WebView
# versions affected by CVE-2026-11167.
#
# Logic:
# - Vulnerable if installed version is < 149.0.7827.53
# - Patched if installed version is >= 149.0.7827.53
# - Checks both Chrome and Android System WebView if present
#
# Exit codes:
# 0 = PATCHED
# 1 = VULNERABLE
# 2 = UNKNOWN / unable to determine

set -u

THRESHOLD="149.0.7827.53"
SERIAL_ARG="${1:-}"
ADB=(adb)
if [[ -n "$SERIAL_ARG" ]]; then
  ADB+=( -s "$SERIAL_ARG" )
fi

packages=("com.android.chrome" "com.google.android.webview")
found_any=0
vulnerable_any=0
unknown_any=0

version_ge() {
  # returns 0 if $1 >= $2
  local a b IFS=.
  read -r -a a <<< "$1"
  read -r -a b <<< "$2"
  local len=${#a[@]}
  if (( ${#b[@]} > len )); then len=${#b[@]}; fi
  for ((i=0; i<len; i++)); do
    local ai=${a[i]:-0}
    local bi=${b[i]:-0}
    if ((10#$ai > 10#$bi)); then return 0; fi
    if ((10#$ai < 10#$bi)); then return 1; fi
  done
  return 0
}

get_version() {
  local pkg="$1"
  "${ADB[@]}" shell dumpsys package "$pkg" 2>/dev/null | tr -d '\r' | awk -F= '/versionName=/{print $2; exit}'
}

# Basic adb connectivity check
if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN - adb device not available or unauthorized"
  exit 2
fi

echo "Checking threshold: $THRESHOLD"

for pkg in "${packages[@]}"; do
  ver="$(get_version "$pkg")"
  if [[ -z "$ver" ]]; then
    echo "$pkg: not installed or version unknown"
    unknown_any=1
    continue
  fi

  found_any=1
  echo "$pkg: installed version $ver"

  if version_ge "$ver" "$THRESHOLD"; then
    echo "$pkg: PATCHED"
  else
    echo "$pkg: VULNERABLE"
    vulnerable_any=1
  fi
done

if (( found_any == 0 )); then
  echo "UNKNOWN - neither Chrome nor Android System WebView version could be determined"
  exit 2
fi

if (( vulnerable_any == 1 )); then
  echo "VULNERABLE"
  exit 1
fi

if (( unknown_any == 1 )); then
  echo "UNKNOWN - at least one relevant package could not be evaluated"
  exit 2
fi

echo "PATCHED"
exit 0

Sources

1. NVD record for CVE-2026-11167
2. Chrome Releases: Stable Channel Update for Desktop
3. Chrome Releases: Chrome for Android Update
4. Chromium issue 502228856
5. CVE.org record
6. CISA Known Exploited Vulnerabilities Catalog
7. VulDB entry for CVE-2026-11167
8. Quanteta CVE tracker entry set