CVE-2026-11290: Google Chrome Android DoS Vulnerability

CVE-2026-11290 Overview

CVE-2026-11290 is an integer overflow vulnerability in the WebView component of Google Chrome on Android. The flaw affects Chrome versions prior to 149.0.7827.53. A local attacker can trigger the overflow by supplying a malicious file to the WebView, causing a denial of service on the affected device.

The issue is tracked under [CWE-190] (Integer Overflow or Wraparound) and [CWE-472] (External Control of Assumed-Immutable Web Parameter). Chromium classifies the security severity as Low, while the NVD assigns a MEDIUM rating because of the high availability impact on the host application.

Critical Impact
A local attacker can crash the Chrome WebView on Android by delivering a crafted file, disrupting any application that embeds WebView for rendering web content.

Affected Products

Google Chrome on Android prior to 149.0.7827.53
Android applications embedding the vulnerable Chrome WebView component
Chromium-based WebView builds preceding the 149 stable channel update

Discovery Timeline

2026-06-05 - CVE-2026-11290 published to NVD
2026-06-05 - Last updated in NVD database

Technical Details for CVE-2026-11290

Vulnerability Analysis

The vulnerability resides in WebView, the Android system component that renders web content inside native applications. WebView processes file inputs through routines that perform arithmetic on size or offset fields. When attacker-controlled values exceed the bounds of the integer type, the result wraps around and produces an incorrect size calculation.

The miscalculation propagates into downstream allocation or indexing logic. The resulting inconsistent state causes the rendering process to terminate, producing a denial of service. Exploitation requires the user to open or load the malicious file through an application that surfaces WebView rendering.

The vulnerability does not provide read or write primitives over confidential data. The CVSS vector reflects no confidentiality or integrity impact and a high availability impact, consistent with a crash-only outcome.

Root Cause

The root cause is unchecked arithmetic on size or length values parsed from a file consumed by WebView. The affected code path trusts an externally controlled parameter without validating that subsequent computations remain within the bounds of the underlying integer type, which aligns with the [CWE-472] and [CWE-190] classifications.

Attack Vector

Attack delivery is local. An attacker must place a malicious file where a target application loads it into WebView, or must convince the user to open the file. User interaction is required, and the attacker needs only low privileges on the device.

The vulnerability cannot be triggered remotely over the network without an additional vector that delivers the file to the device. Refer to the Chromium Issue Tracker Entry and the Google Chrome Releases Blog for vendor-published technical context.

Detection Methods for CVE-2026-11290

Indicators of Compromise

Repeated crashes of com.google.android.webview or host applications using WebView shortly after opening files.
Android tombstoned or logcat entries showing SIGSEGV or abort signals originating in WebView rendering threads.
Presence of unexpected files with unusual size or offset header fields delivered through messaging, email, or sideloaded applications.

Detection Strategies

Inventory installed Chrome and WebView versions across the Android fleet and flag any build older than 149.0.7827.53.
Correlate application crash telemetry with file-open events to identify suspicious patterns consistent with malicious file delivery.
Monitor mobile device management (MDM) signals for users running outdated Chrome or System WebView packages.

Monitoring Recommendations

Forward Android crash logs and Google Play Protect alerts to a central logging pipeline for correlation.
Track WebView and Chrome update compliance as a security KPI for Android endpoints.
Alert on file deliveries with mismatched declared sizes or malformed metadata processed by WebView-enabled apps.

How to Mitigate CVE-2026-11290

Immediate Actions Required

Update Google Chrome for Android to 149.0.7827.53 or later through Google Play.
Update Android System WebView to the latest stable channel release on all managed devices.
Restrict installation of untrusted applications and files that could be loaded by WebView-enabled apps.

Patch Information

Google fixed CVE-2026-11290 in Chrome for Android 149.0.7827.53. The fix ships through the Chrome stable channel and the Android System WebView package. Details of the stable channel release are documented in the Google Chrome Releases Blog, with the underlying tracker entry available in the Chromium Issue Tracker.

Workarounds

Avoid opening untrusted files in applications that embed Chrome WebView until patches are applied.
Use MDM policies to enforce automatic updates for Chrome and Android System WebView.
Configure host applications to validate file inputs before passing them to WebView rendering APIs.

bash

# Verify installed Chrome and WebView versions on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
adb shell dumpsys package com.google.android.webview | grep versionName