CVE-2026-11247

LowCVSS 3.1

Published: 05/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

Google Chrome on Android prior to version 149.0.7827.53 has a vulnerability in CustomTabs due to insufficient policy enforcement. A remote attacker can leak cross-origin data via a crafted HTML page.

Risk Assessment

The risk involves potential cross-origin data leakage, which could lead to disclosure of sensitive user information.

Recommendation

Update Google Chrome on Android to version 149.0.7827.53 or later.

Original NVD description (English source)

Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)