CVE-2026-11247 Overview
CVE-2026-11247 is an insufficient policy enforcement vulnerability in the CustomTabs component of Google Chrome on Android. The flaw affects Chrome versions prior to 149.0.7827.53. A remote attacker can leak cross-origin data by serving a crafted HTML page to a victim. Exploitation requires user interaction and high attack complexity, limiting practical impact. Google classified the Chromium security severity as Low. The vulnerability maps to [CWE-693: Protection Mechanism Failure].
Critical Impact
Successful exploitation leaks cross-origin data from the Android Chrome browser, undermining the same-origin policy enforced by CustomTabs.
Affected Products
- Google Chrome for Android prior to 149.0.7827.53
- Google Android operating system hosting vulnerable Chrome builds
- CustomTabs component within Chromium
Discovery Timeline
- 2026-06-05 - CVE-2026-11247 published to NVD
- 2026-06-05 - Last updated in NVD database
Technical Details for CVE-2026-11247
Vulnerability Analysis
The vulnerability resides in Chrome's CustomTabs implementation on Android. CustomTabs let native apps embed a Chrome browsing surface while preserving the user's session and browser features. The component must enforce origin and navigation policies that isolate one site's data from another. CVE-2026-11247 represents a gap in those policy checks, allowing a crafted HTML page to access information from a different origin. The result is cross-origin information disclosure rather than code execution or tampering. Chromium's Issue Tracker entry 497865734 documents the underlying defect.
Root Cause
The root cause is insufficient enforcement of cross-origin policy boundaries inside CustomTabs. CustomTabs did not consistently apply restrictions that prevent one origin from reading data scoped to another. This pattern aligns with [CWE-693], where a protection mechanism is present but fails under specific conditions. The defect required user interaction and complex preconditions to trigger reliably.
Attack Vector
Exploitation is remote and delivered through web content. An attacker hosts a crafted HTML page and lures an Android Chrome user into loading it through a CustomTabs surface. The page leverages the missing policy enforcement to read data belonging to a separate origin. No privileges or credentials are required on the device. The leaked data is limited in scope, consistent with a low confidentiality impact rating.
No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for technical details once Google unrestricts the bug report.
Detection Methods for CVE-2026-11247
Indicators of Compromise
- Android Chrome installations reporting versions earlier than 149.0.7827.53 in enterprise inventory data
- Unexpected CustomTabs invocations from third-party Android apps loading external HTML pages
- Outbound requests to attacker-controlled domains immediately after a CustomTabs session opens
Detection Strategies
- Inventory Android endpoints and query the installed Chrome version via mobile device management (MDM) telemetry
- Monitor web proxy and DNS logs for users visiting newly registered or low-reputation domains delivered through embedded browser surfaces
- Correlate Android application install events with subsequent CustomTabs network activity to flag suspicious app-to-browser handoffs
Monitoring Recommendations
- Ingest MDM compliance reports into a centralized log platform to track Chrome patch coverage across the mobile fleet
- Alert on Android devices that remain on Chrome builds older than 149.0.7827.53 beyond an organization-defined grace period
- Review threat intelligence feeds for active campaigns abusing Chromium CustomTabs cross-origin issues
How to Mitigate CVE-2026-11247
Immediate Actions Required
- Update Google Chrome for Android to version 149.0.7827.53 or later through the Google Play Store
- Enforce mobile patch compliance policies that block access to corporate resources from outdated Chrome builds
- Communicate the update requirement to end users with bring-your-own-device (BYOD) Android handsets
Patch Information
Google addressed CVE-2026-11247 in the Chrome Stable Channel update referenced in the Google Chrome Update Announcement. Install Chrome 149.0.7827.53 or any subsequent release to remediate the issue. Devices receive the fix automatically through the Play Store update channel when auto-update is enabled.
Workarounds
- Avoid opening links from untrusted Android apps that launch CustomTabs sessions until Chrome is updated
- Restrict installation of unvetted third-party Android applications through MDM allow-listing
- Configure enterprise mobility policies to require minimum Chrome versions before granting network access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
