Incorrect security UI in Messages in Google Chrome on Android prior to 149

CVE-2026-11175 is a Chrome on Android UI spoofing flaw in the Messages component. A malicious site can trigger incorrect security UI on vulnerable Chrome for Android builds before 149.0.7827.53, letting an attacker make browser chrome or trust cues look more legitimate than they are via a crafted HTML page.

The vendor's HIGH 8.8 score overstates real enterprise risk. In practice this is not remote code execution, sandbox escape, or device takeover; it is a social-engineering assist that still requires the victim to open attacker-controlled content and then trust or act on a spoofed prompt or indicator. That makes it meaningful for phishing-resistant orgs, but not a drop-everything emergency.

Why this verdict

• UI:R is real friction — the attacker must get the user onto malicious content and then convince them to act on the spoof
• Android-only scope narrows population compared with a cross-platform Chrome issue, which materially reduces reachable enterprise exposure
• This is a spoofing primitive, not host compromise — no direct RCE, no sandbox breakout, and no automatic lateral movement from the bug itself
• Low threat intel heat — no KEV entry, no confirmed in-the-wild activity, and an EPSS of 0.0007 all argue against emergency-tier handling
• Widespread deployment keeps it above LOW — Chrome on Android is common in managed mobile fleets, so even a phishing helper can affect a lot of users if left stale

Why not higher?

A higher rating would need either active exploitation, a publicly weaponized PoC, or a path to direct device/browser compromise. None of those signals are present here. The chain also compounds friction: remote lure plus user click plus successful deception plus reusable business impact.

Why not lower?

It is not LOW because security UI is part of the trust boundary in a browser, especially on mobile where screen real estate hides context and users move quickly through auth flows. In enterprises that rely on mobile SSO, phishing-resistant design failures can still translate into credential theft or fraudulent approvals.

1. Force Chrome auto-update through EMM — Use Managed Google Play / Android Enterprise policy to keep com.android.chrome current and block long-lived stale versions. For a MEDIUM noisgate verdict there is no mitigation SLA — go straight to the 365-day remediation window, but this is cheap hygiene and should be turned on now if it is not already.
2. Constrain unmanaged mobile browsing — Where business apps depend on mobile web auth, require managed devices and managed browsers for sensitive workflows. There is no mitigation SLA for MEDIUM, so treat this as control hardening while completing remediation within 365 days.
3. Lean on phishing-resistant auth — FIDO2/passkeys, number matching, and tight conditional access reduce the value of spoofed trust indicators because a fake page cannot easily replay possession-bound authentication. There is no mitigation SLA for MEDIUM, but this materially cuts consequence while the fleet ages out stale versions.
4. Raise detections on mobile-origin phishing — Correlate mobile click telemetry, Safe Browsing blocks, IdP sign-in anomalies, and impossible-travel detections to catch the *follow-on abuse* this CVE is most likely to enable. Again, no mitigation SLA here; use the normal security engineering cycle while remediating the vulnerable app version inside 365 days.

Run this from an auditor workstation with adb installed against a USB-connected or network-connected Android device that has developer access authorized. Example: python check_chrome_android_cve_2026_11175.py --serial R58N1234567. It needs permission to run adb shell dumpsys package com.android.chrome; no root is required.

#!/usr/bin/env python3
# Check Google Chrome on Android for CVE-2026-11175
# Outputs: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/dependency error

import argparse
import re
import shutil
import subprocess
import sys

FIXED = (149, 0, 7827, 53)
PKG = "com.android.chrome"


def parse_version(v):
    m = re.findall(r"\d+", v or "")
    if len(m) < 4:
        return None
    return tuple(int(x) for x in m[:4])


def cmp_ver(a, b):
    return (a > b) - (a < b)


def run(cmd):
    try:
        p = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
        return p.returncode, p.stdout, p.stderr
    except Exception as e:
        return 99, "", str(e)


def get_version(serial=None):
    adb = shutil.which("adb")
    if not adb:
        print("UNKNOWN - adb not found in PATH")
        sys.exit(3)

    base = [adb]
    if serial:
        base += ["-s", serial]

    rc, out, err = run(base + ["shell", "dumpsys", "package", PKG])
    if rc != 0:
        print(f"UNKNOWN - failed to query package via adb: {err.strip() or out.strip()}")
        sys.exit(2)

    # Try common fields first
    for line in out.splitlines():
        line = line.strip()
        m = re.search(r"versionName=([^\s]+)", line)
        if m:
            return m.group(1)

    # Fallback: parse package dump more loosely
    m = re.search(r"versionName=([^\s]+)", out)
    if m:
        return m.group(1)

    return None


def main():
    ap = argparse.ArgumentParser(description="Check Chrome on Android for CVE-2026-11175")
    ap.add_argument("--serial", help="adb device serial", default=None)
    args = ap.parse_args()

    version = get_version(args.serial)
    if not version:
        print("UNKNOWN - could not determine Chrome version")
        sys.exit(2)

    parsed = parse_version(version)
    if not parsed:
        print(f"UNKNOWN - unrecognized version format: {version}")
        sys.exit(2)

    if cmp_ver(parsed, FIXED) < 0:
        print(f"VULNERABLE - {PKG} version {version} is older than 149.0.7827.53")
        sys.exit(1)
    else:
        print(f"PATCHED - {PKG} version {version} is 149.0.7827.53 or newer")
        sys.exit(0)


if __name__ == "__main__":
    main()

Sources

1. Chrome Releases blog
2. VulDB entry for CVE-2026-11175
3. GovCERT HK alert for Chrome 149 vulnerabilities
4. CISA Known Exploited Vulnerabilities Catalog
5. FIRST EPSS API documentation
6. FIRST EPSS data and stats
7. Google Chrome Help: Update Chrome on Android
8. Google Chrome on Google Play