Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149

CVE-2026-11172 is a security UI spoofing flaw in Google Chrome on Android involving the Contact Picker. A malicious site can abuse the browser's UI flow so the user sees misleading trust signals while interacting with attacker-controlled content, enabling phishing-style deception. Based on the vendor description, affected builds are Chrome on Android prior to 149.0.7827.53.

Google's HIGH 8.8 rating is technically explainable from a generic network/user-interaction template, but it overstates enterprise risk. This bug does not give the attacker code execution, sandbox escape, persistence, or silent data theft by itself; it gives them a better costume for a phishing page. The decisive downgrade factors are Android-only scope, required user interaction, per-victim blast radius, and the fact that modern email/web filtering can still kill the campaign before the browser bug matters.

Why this verdict

• Requires user interaction: the attacker cannot silently trigger impact; they need a victim to tap into a deceptive flow.
• Android Chrome only: this is not a cross-platform Chrome emergency and not a server-side exposure affecting shared enterprise infrastructure.
• UI spoofing is downstream-impact dependent: the bug does not directly execute code, escape sandboxing, or persist on the device; harm depends on what the victim does next.
• Exposure population is narrower than the CVSS suggests: only devices with vulnerable Android Chrome builds, reachable by a phishing campaign, and used for sensitive workflows are materially at risk.
• No KEV and no active exploitation evidence: absent exploitation pressure, the real-world urgency is lower than a browser memory-corruption bug with working exploit chains.
• Modern controls break the chain before and after the bug: email/web filtering, Safe Browsing, MFA, passkeys, and conditional access all reduce practical impact.

Why not higher?

This does not look like a pre-auth browser RCE, sandbox escape, or universal account bypass. Even if the spoof is convincing, the attacker still needs delivery, a click, successful deception, and then a second-stage outcome such as credential entry or contact sharing. That compound friction is exactly why the vendor's 8.8 does not survive contact with reality.

Why not lower?

It is still a browser trust-boundary failure in a widely deployed product, and mobile UI spoofing can materially improve phishing conversion. For organizations with Android-heavy workforces, especially where users handle SSO or approvals on phones, this can still produce credential theft or data disclosure. That keeps it above backlog hygiene.

1. Force Chrome auto-update on Android — Use Managed Google Play / EMM / MDM policy to drive Chrome 149.0.7827.53+ across enrolled Android devices. For a MEDIUM verdict there is no mitigation SLA, so treat this as normal patching and complete it within the 365-day remediation window.
2. Block risky link delivery paths — Tighten mail, SMS, chat, and QR-code link protections because this bug only matters after a user reaches attacker-controlled content. Prioritize phishing-resistant filtering now; for MEDIUM, there is no mitigation SLA — go straight to the 365-day remediation window for the software fix.
3. Enforce phishing-resistant auth — Require passkeys, FIDO2, or strong MFA with conditional access for mobile sign-ins so a spoofed UI has less payoff even if a user is fooled. This does not replace patching, but it sharply reduces account-takeover value while you work through the 365-day remediation window.
4. Inventory Android browser drift — Report devices still on vulnerable Chrome builds and separate managed from BYOD/unmanaged populations. This is the right control for a client-side bug because internet scanning is useless here; for MEDIUM, close the version gap within the 365-day remediation window.

Run this from an auditor workstation with ADB installed against a USB- or network-connected Android device. Invoke it as ./check_chrome_android_cve_2026_11172.sh <device-serial>; it needs no root on the phone, but the device must allow ADB and expose package info.

#!/usr/bin/env bash
# check_chrome_android_cve_2026_11172.sh
# Determine whether Google Chrome on an Android device is vulnerable to CVE-2026-11172
# Vulnerable if com.android.chrome version is less than 149.0.7827.53
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/dependency error

set -u

PKG="com.android.chrome"
FIXED="149.0.7827.53"

if ! command -v adb >/dev/null 2>&1; then
  echo "UNKNOWN - adb not found in PATH"
  exit 3
fi

if [ "$#" -ne 1 ]; then
  echo "Usage: $0 <device-serial>"
  exit 3
fi

SERIAL="$1"

adb -s "$SERIAL" get-state >/dev/null 2>&1
if [ "$?" -ne 0 ]; then
  echo "UNKNOWN - device $SERIAL not reachable via adb"
  exit 2
fi

VERSION_LINE=$(adb -s "$SERIAL" shell dumpsys package "$PKG" 2>/dev/null | tr -d '\r' | grep -m1 'versionName=')
if [ -z "$VERSION_LINE" ]; then
  echo "UNKNOWN - package $PKG not found or package info unavailable"
  exit 2
fi

VERSION="${VERSION_LINE#*versionName=}"
VERSION="$(echo "$VERSION" | awk '{print $1}')"

normalize_version() {
  # Convert dotted version into zero-padded comparable string
  # Non-numeric suffixes are stripped per segment.
  local ver="$1"
  local IFS='.'
  read -r -a parts <<< "$ver"
  local out=""
  local i part num
  for i in 0 1 2 3; do
    part="${parts[$i]:-0}"
    num="$(echo "$part" | sed 's/[^0-9].*$//')"
    [ -z "$num" ] && num=0
    out+=$(printf '%08d' "$num")
  done
  echo "$out"
}

INSTALLED_NORM=$(normalize_version "$VERSION")
FIXED_NORM=$(normalize_version "$FIXED")

if [ -z "$INSTALLED_NORM" ] || [ -z "$FIXED_NORM" ]; then
  echo "UNKNOWN - failed to parse version (installed: $VERSION)"
  exit 2
fi

if [[ "$INSTALLED_NORM" < "$FIXED_NORM" ]]; then
  echo "VULNERABLE - $PKG version $VERSION is older than fixed $FIXED"
  exit 1
else
  echo "PATCHED - $PKG version $VERSION is at or newer than fixed $FIXED"
  exit 0
fi

Sources

1. Chrome Releases: Chrome for Android Update (149.0.7827.48 early stable)
2. Chrome Releases: Early Stable Update for Desktop (149.0.7827.53/.54)
3. Chrome Developers: Contact Picker API
4. Chromium issue 40057591: Security UI Spoofing on Chrome for Android due to Contact permission dialog/fullscreen interaction
5. Chromium issue 499476146: Address Bar Spoofing via Fullscreen API & UI Redressing on Chrome Android
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS overview
8. Quanteta CVE Tracker entry showing public aggregation for CVE-2026-11172