Inappropriate implementation in Page Info in Google Chrome on Android prior to 149

CVE-2026-11275 is an *Android Chrome* flaw in the Page Info surface that lets an attacker who has already compromised the renderer process bypass navigation restrictions using a crafted HTML page. The affected range is Google Chrome on Android before 149.0.7827.53; the user-provided disclosure date is 2026-06-05. This is not a first-stage browser RCE by itself, and it is not an OS sandbox escape by itself.

The vendor's MEDIUM 6.5 is too generous for enterprise patch triage because the decisive prerequisite is enormous: the attacker must first land a separate renderer compromise. That means this bug is mostly useful as a *post-exploitation chain component* inside Chrome, not as a broad internet-scale entry point. Chrome's own upstream labeling reflected that reality by calling the Chromium security severity Low.

Why this verdict

• Massive prerequisite downgrade: the attacker must *already* have compromised Chrome's renderer process, which implies a separate exploit chain and pushes this out of the initial-access bucket.
• Reachability is narrow: this is Android Chrome only, user-driven, and client-side; there is no internet-exposed service to spray at scale across your estate.
• Threat signals are weak: no KEV listing, no confirmed public in-the-wild exploitation found, no public PoC found, and the user-provided EPSS of 0.0002 is extremely low.

Why not higher?

A higher rating would require either evidence of active exploitation, a reliable public exploit chain, or a bug that stands on its own as an entry point. This one does none of that. The need for an existing renderer foothold is compounding downward pressure because it assumes the attacker has already cleared the hardest part.

Why not lower?

It is still a real security boundary failure inside one of the most widely deployed browsers on mobile, and integrity-impact bugs in browser navigation can support phishing or workflow abuse. If an actor already has a renderer exploit, this bug can improve the quality of that chain, so it is not ignorable noise.

1. Enforce Chrome auto-update on managed Android — Use EMM / managed Google Play policy to keep Chrome on current stable so vulnerable builds age out naturally. For a LOW verdict, there is no SLA beyond backlog hygiene, so fold this into the normal mobile app maintenance cycle rather than emergency work.
2. Block stale browser versions from high-risk workflows — Apply conditional access or web access policy for sensitive internal apps where feasible, especially for identity, finance, and admin portals. This reduces the value of browser-integrity abuse and can be rolled into your normal policy-review cycle because there is no urgent mitigation clock here.
3. Reduce first-stage browser exploit exposure — Keep Safe Browsing protections enabled, restrict sideloading, and use mobile threat defense or secure web gateway controls where available. The best defense here is stopping the *separate renderer compromise* that this CVE depends on.
4. Inventory Android Chrome laggards — Query your device fleet for versions below 149.0.7827.53 and identify devices not receiving Play updates. Treat remediation as routine backlog hygiene unless new exploitation evidence appears.

Run this from an auditor workstation that has adb access to the target Android device; no root is required, but the device must allow ADB/managed debugging. Invoke it as ./check_cve_2026_11275.sh <device-serial> or, for a single attached device, just ./check_cve_2026_11275.sh.

#!/usr/bin/env bash
# check_cve_2026_11275.sh
# Detects whether Google Chrome on Android is below 149.0.7827.53
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

PKG="com.android.chrome"
FIXED="149.0.7827.53"
SERIAL="${1:-}"
ADB=(adb)

if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

fail_unknown() {
  echo "UNKNOWN: $1"
  exit 2
}

ver_lt() {
  # returns 0 if $1 < $2 using version sort
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$1" != "$2" && "$first" == "$1" ]]
}

command -v adb >/dev/null 2>&1 || fail_unknown "adb not found in PATH"

${ADB[@]} get-state >/dev/null 2>&1 || fail_unknown "no reachable Android device via adb"

pkg_path=$(${ADB[@]} shell pm path "$PKG" 2>/dev/null | tr -d '\r')
[[ -n "$pkg_path" ]] || fail_unknown "Chrome package $PKG not installed or not visible"

version=$(${ADB[@]} shell dumpsys package "$PKG" 2>/dev/null | tr -d '\r' | sed -n 's/.*versionName=\([^ ]*\).*/\1/p' | head -n1)
[[ -n "$version" ]] || fail_unknown "could not determine Chrome versionName"

if ver_lt "$version" "$FIXED"; then
  echo "VULNERABLE: Chrome version $version is below fixed version $FIXED"
  exit 1
else
  echo "PATCHED: Chrome version $version is at or above fixed version $FIXED"
  exit 0
fi

Sources

1. SUSE CVE record mirroring upstream description and CVSS
2. Chrome for Android early stable 149 release post
3. Chrome Releases blog index
4. Chrome Enterprise and Education previous release notes
5. CISA Known Exploited Vulnerabilities catalog
6. FIRST EPSS overview
7. FIRST EPSS API documentation
8. CVE Program record portal