Inappropriate implementation in WebView in Google Chrome on Android prior to 149

CVE-2026-11295 is a WebView flaw affecting Google Chrome on Android before 149.0.7827.53, with the Android stable train carrying the corresponding fixes in Chrome for Android 149.0.7827.59. The public description says a remote attacker can trigger privilege escalation with a crafted HTML page, which means the bug is at least content-reachable from web content shown in Chrome or an app embedding Chromium-based WebView.

The severity story is where this falls apart. Your supplied 8.8/HIGH label does not match Chrome's own June 2, 2026 release notes, which classify CVE-2026-11295 as Low; absent bug details, public exploit code, KEV status, or evidence that this is a one-bug remote-to-system chain, the vendor-style CVSS overstates enterprise urgency. For a team managing 10,000 hosts, this is a mobile-client patching item, not a queue-jumping incident.

Why this verdict

• Vendor conflict matters: the official Chrome release note for June 2, 2026 labels CVE-2026-11295 as Low, so I am explicitly adjusting down from the supplied 8.8/HIGH baseline.
• Requires attacker-to-user content delivery: this is UI:R, which means the attacker needs the victim to render crafted HTML in Chrome/WebView rather than hitting an always-on service.
• Android/WebView only shrinks the reachable population: this is not your Windows/macOS/Linux browser fleet, and in many enterprises only a subset of users even sit in scope.
• No exploit signal: no KEV entry, no public PoC, and no public campaign reporting means there is no threat-intel amplifier pushing this upward.
• Blast radius is narrow: the realistic impact starts at one mobile app/browser context on one device, not broad unauthenticated network compromise.

Why not higher?

If this were a demonstrated remote-to-system privilege escalation with no meaningful preconditions, Chrome would not be rating it Low. The missing pieces are exactly the ones that matter operationally: public exploitability detail, exploitation evidence, and proof that the privilege gain crosses a strong boundary in a reliable way.

Why not lower?

I am not calling it IGNORE because it is still a real security fix in a ubiquitous mobile rendering engine, and the public description does say privilege escalation from crafted web content. Even when the practical exploit story looks weak, remote content-reachable bugs in browsers/WebView deserve eventual patch coverage and version compliance.

1. Enforce auto-update compliance — Use MDM/EMM plus managed Google Play policy to keep Chrome on Android and Android System WebView current. For a LOW noisgate verdict there is no SLA (treat as backlog hygiene), so fold this into your normal mobile compliance cycle rather than emergency change windows.
2. Inventory lagging Android browsers — Pull package/version inventory for com.android.chrome and com.google.android.webview, then flag devices below the fixed train. Again, LOW means no SLA (treat as backlog hygiene); this is a cleanup task for your next routine mobile patch sweep.
3. Constrain unmanaged browsing paths — Where policy allows, force enterprise links into the managed browser profile and restrict risky unmanaged apps that embed WebView for sensitive workflows. This reduces exposure while you clean up laggards, but for LOW there is no mitigation SLA beyond ordinary control hygiene.

Run this on an auditor workstation with adb installed, pointed at a USB-connected or enterprise-debuggable Android device. Invoke it as ./check_cve_2026_11295.sh <device-serial> or just ./check_cve_2026_11295.sh for the only attached device; it needs adb shell access but no root.

#!/usr/bin/env bash
# check_cve_2026_11295.sh
# Verify exposure to CVE-2026-11295 on an Android device via adb.
# Outputs exactly one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

TARGET_FIX="149.0.7827.53"
SERIAL="${1:-}"
ADB=(adb)
if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

have_cmd() {
  command -v "$1" >/dev/null 2>&1
}

if ! have_cmd adb; then
  echo "UNKNOWN"
  exit 2
fi

get_version() {
  local pkg="$1"
  "${ADB[@]}" shell dumpsys package "$pkg" 2>/dev/null | sed -n 's/.*versionName=//p' | head -n1 | tr -d '\r'
}

ver_ge() {
  # returns 0 if $1 >= $2
  [[ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | tail -n1)" == "$1" ]]
}

STATE=$("${ADB[@]}" get-state 2>/dev/null || true)
if [[ "$STATE" != "device" ]]; then
  echo "UNKNOWN"
  exit 2
fi

CHROME_VER=$(get_version com.android.chrome)
WEBVIEW_VER=$(get_version com.google.android.webview)
TRICHROME_VER=$(get_version com.google.android.trichromelibrary)

# Prefer direct app/package evidence. If Chrome or WebView exists and is below the fixed train, mark vulnerable.
if [[ -n "$CHROME_VER" ]]; then
  if ver_ge "$CHROME_VER" "$TARGET_FIX"; then
    CHROME_STATUS="PATCHED"
  else
    CHROME_STATUS="VULNERABLE"
  fi
else
  CHROME_STATUS="UNKNOWN"
fi

if [[ -n "$WEBVIEW_VER" ]]; then
  if ver_ge "$WEBVIEW_VER" "$TARGET_FIX"; then
    WEBVIEW_STATUS="PATCHED"
  else
    WEBVIEW_STATUS="VULNERABLE"
  fi
else
  WEBVIEW_STATUS="UNKNOWN"
fi

# If either installed component is explicitly vulnerable, call it vulnerable.
if [[ "$CHROME_STATUS" == "VULNERABLE" || "$WEBVIEW_STATUS" == "VULNERABLE" ]]; then
  echo "VULNERABLE"
  exit 1
fi

# If at least one relevant component is present and patched, call it patched.
if [[ "$CHROME_STATUS" == "PATCHED" || "$WEBVIEW_STATUS" == "PATCHED" ]]; then
  echo "PATCHED"
  exit 0
fi

# Fallback hint: trichrome library may exist on some builds, but alone is not enough for a definitive call.
if [[ -n "$TRICHROME_VER" ]]; then
  if ver_ge "$TRICHROME_VER" "$TARGET_FIX"; then
    echo "UNKNOWN"
    exit 2
  fi
fi

echo "UNKNOWN"
exit 2

Sources

1. Chrome Releases: Stable Channel Update for Desktop (June 2, 2026)
2. Chrome Releases: Chrome for Android Update (June 2, 2026)
3. Chromium severity guidelines
4. Chromium Security page
5. Chromium issue 502444677
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS data and stats
8. Android Developers: Jetpack Webkit overview