Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149

CVE-2026-11263 is an *insufficient policy enforcement* flaw in WebAuthentication in Google Chrome on Android affecting versions prior to 149.0.7827.53. The supplied description matters more than the vendor CVSS here: exploitation requires a remote attacker who has already compromised the renderer process and then uses a crafted HTML page to leak cross-origin data. In plain English, this is not the bug that gets an attacker into the browser; it is the bug that helps after they already landed code execution in the renderer.

The vendor's MEDIUM 6.5 overstates operational urgency for enterprise patch triage. A browser bug with PR:N/UI:R looks middling on paper, but the real attack chain has a huge hidden prerequisite: separate renderer compromise first. That turns this into a post-initial-browser-compromise, Android-only, confidentiality-only issue with narrow standalone value, so the real-world priority drops hard.

Why this verdict

• Massive prerequisite hidden by CVSS: the description requires a *compromised renderer process* first, which implies a separate successful browser exploit stage before this CVE matters.
• Reachable population is narrower than it looks: this is Chrome on Android, not all Chrome platforms, and it depends on a WebAuthentication-specific path after compromise.
• Blast radius is limited: stated impact is cross-origin data leakage only; there is no direct RCE, no stated sandbox escape, and no availability impact.

Why not higher?

If this were a one-bug chain from web content to account/session compromise, or if there were active exploitation/KEV evidence, this would climb fast. But as documented, it is a follow-on primitive after renderer compromise, which is exactly the sort of compounding friction that should pull severity down.

Why not lower?

It is still a real security boundary failure in a massively deployed client, and once the prerequisite is met it can expose sensitive cross-origin data. That keeps it above IGNORE: if you already worry about mobile browser exploit chains for high-risk users, this bug is part of that story.

1. Enforce Chrome auto-update on managed Android — Use EMM/MDM policy and Play managed app settings to keep com.android.chrome current. For a LOW verdict there is no mitigation SLA; treat this as backlog hygiene and verify your mobile app update policy during the normal remediation cycle.
2. Report Chrome versions from device inventory — Pull package version telemetry from your UEM/MDM or via adb for sampled devices so you can identify stragglers below 149.0.7827.53. For LOW, do this as part of routine fleet hygiene rather than as an emergency exception.
3. Harden high-risk browsing personas — For executives, admins, and targeted users, consider remote/browser isolation or stricter mobile browsing profiles because this CVE only becomes useful inside a broader browser exploit chain. That is where the defensive value sits.
4. Reduce unmanaged Android browser variance — Standardize on managed Chrome channels and block stale sideloaded browsers where policy allows. The main operational risk is version drift, not internet exposure.

Run this on an auditor workstation with adb installed and a USB- or network-connected Android device. Invoke it as bash check_chrome_android_cve_2026_11263.sh <serial> or bash check_chrome_android_cve_2026_11263.sh for the default device; it needs ADB access only, no root.

#!/usr/bin/env bash
# check_chrome_android_cve_2026_11263.sh
# Verifies whether Google Chrome on Android is below 149.0.7827.53.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

PKG="com.android.chrome"
FIXED="149.0.7827.53"
SERIAL="${1:-}"
ADB=(adb)

if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

ver_lt() {
  # returns 0 if $1 < $2
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" != "$2" ]]
}

if ! have_cmd adb; then
  echo "UNKNOWN: adb not found in PATH"
  exit 2
fi

if ! "${ADB[@]}" get-state >/dev/null 2>&1; then
  echo "UNKNOWN: no reachable Android device via adb"
  exit 2
fi

VERSION_RAW=$("${ADB[@]}" shell dumpsys package "$PKG" 2>/dev/null | tr -d '\r' | awk -F= '/versionName=/{print $2; exit}')

if [[ -z "$VERSION_RAW" ]]; then
  VERSION_RAW=$("${ADB[@]}" shell pm list packages -f "$PKG" 2>/dev/null | tr -d '\r')
  if [[ -z "$VERSION_RAW" ]]; then
    echo "UNKNOWN: package $PKG not found"
    exit 2
  fi
  echo "UNKNOWN: package found but versionName unavailable"
  exit 2
fi

VERSION=$(echo "$VERSION_RAW" | sed 's/[^0-9.].*$//')

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN: could not parse Chrome version from '$VERSION_RAW'"
  exit 2
fi

if ver_lt "$VERSION" "$FIXED"; then
  echo "VULNERABLE: Chrome Android version $VERSION is below fixed version $FIXED"
  exit 1
else
  echo "PATCHED: Chrome Android version $VERSION is at or above fixed version $FIXED"
  exit 0
fi

Sources

1. Chrome for Android Update (149.0.7827.48 early stable)
2. Chrome Early Stable Update for Desktop (149.0.7827.53/.54)
3. Google Chrome on Google Play
4. Update Google Chrome on Android
5. How to update apps on Android
6. FIRST EPSS API documentation
7. CISA Known Exploited Vulnerabilities Catalog
8. GovCERT.HK alert for Chrome 149 vulnerabilities