CVE-2026-11287: Chrome Android Auth Bypass Vulnerability

CVE-2026-11287 Overview

CVE-2026-11287 is a navigation policy enforcement weakness affecting Google Chrome on Android prior to version 149.0.7827.53. The flaw allows a remote attacker who has already compromised the renderer process to bypass navigation restrictions through a crafted HTML page. Google's Chromium team rated the issue as low severity, while the National Vulnerability Database assigned a CVSS score of 6.5. The weakness maps to [CWE-20] Improper Input Validation and [CWE-602] Client-Side Enforcement of Server-Side Security. Exploitation requires user interaction and a prior renderer compromise, which limits standalone exploitability but supports sandbox escape chains.

Critical Impact
An attacker controlling a renderer process can bypass navigation restrictions on Android Chrome, enabling integrity violations through crafted HTML pages.

Affected Products

Google Chrome for Android prior to 149.0.7827.53
Google Android devices running affected Chrome builds
Chromium-based mobile browsers sharing the unpatched navigation code

Discovery Timeline

2026-06-05 - CVE-2026-11287 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11287

Vulnerability Analysis

The vulnerability resides in Chrome's Navigation component on Android. Chrome enforces navigation policies to prevent renderer processes from initiating restricted transitions, such as cross-origin loads or scheme-based redirects that bypass browser-level controls. The affected code path fails to fully enforce these policies when handling specific navigation requests originating from a compromised renderer.

An attacker who has already achieved code execution inside the renderer process can issue navigation requests that the browser process accepts without applying expected restrictions. The crafted HTML page acts as the trigger, supplying the navigation primitives the compromised renderer uses to evade policy checks. The integrity impact is high because the attacker can direct the browser to load attacker-controlled content under unintended security contexts.

Root Cause

The root cause is insufficient enforcement of navigation policy in browser-side code that trusts renderer-supplied parameters. Chrome's security model treats renderers as untrusted, so missing or weakened checks at the browser boundary create a sandbox escape primitive. Both [CWE-20] and [CWE-602] apply because security-sensitive decisions are not fully re-validated outside the renderer.

Attack Vector

The attack is network-based and requires user interaction such as visiting a malicious page. The attacker must first compromise the renderer through a separate primitive, then deliver a crafted HTML page that triggers the navigation bypass. No verified public exploit code is available. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor references.

Detection Methods for CVE-2026-11287

Indicators of Compromise

Android Chrome instances reporting versions earlier than 149.0.7827.53 in fleet inventory
Renderer process crashes followed by anomalous navigations to unexpected schemes or origins
Outbound HTTP requests from mobile devices to domains hosting Chromium renderer exploits

Detection Strategies

Inspect Chrome version telemetry on managed Android devices and flag builds below 149.0.7827.53
Correlate browser crash reports with subsequent navigations that violate expected referrer or origin patterns
Monitor mobile EDR telemetry for child process anomalies tied to Chrome on Android

Monitoring Recommendations

Centralize Chrome update status using mobile device management (MDM) compliance reporting
Alert on Chrome Mobile user agents accessing known exploit kit infrastructure or staging domains
Track navigation events that originate from sandboxed contexts and complete in privileged surfaces

How to Mitigate CVE-2026-11287

Immediate Actions Required

Update Google Chrome on Android to version 149.0.7827.53 or later through the Play Store
Enforce minimum Chrome version policies via MDM and block non-compliant devices from sensitive resources
Restrict installation of untrusted Chromium-based browsers that may share the vulnerable code path

Patch Information

Google fixed the issue in Chrome 149.0.7827.53 for Android. Refer to the Google Chrome Desktop Update advisory and the Chromium Issue Tracker Entry for additional context. The Chromium team rated the severity as Low, but the NVD CVSS score of 6.5 reflects integrity impact when chained with a renderer compromise.

Workarounds

Avoid browsing untrusted sites on Android devices until Chrome is updated
Use enterprise browsing policies to disable risky schemes and limit cross-origin navigations
Apply network-layer filtering to block known malicious Chromium exploit hosting infrastructure

bash

# Configuration example: enforce minimum Chrome version via Android Enterprise managed configuration
# Set in your MDM Chrome app configuration profile
MinimumChromeVersion=149.0.7827.53
BlockExternalExtensions=true
URLBlocklist=["javascript://*","data://*"]