CVE-2026-11291 Overview
CVE-2026-11291 is a same-origin policy bypass in the Android Autofill component of Google Chrome on Android. Versions prior to 149.0.7827.53 improperly implement origin checks when handling autofill operations. A remote attacker can deliver a crafted HTML page that abuses this weakness to access data scoped to another origin.
The issue is tracked under CWE-346: Origin Validation Error and was rated low severity by the Chromium project. Exploitation requires user interaction with the malicious page. The flaw affects confidentiality and integrity of data handled by the Autofill subsystem on Android devices.
Critical Impact
A remote attacker can bypass the same-origin policy in Chrome for Android Autofill to read or influence data belonging to a different origin via a crafted web page.
Affected Products
- Google Chrome for Android prior to 149.0.7827.53
- Google Android (Chrome browser component)
- Chromium-based browsers on Android sharing the Autofill implementation
Discovery Timeline
- 2026-06-05 - CVE-2026-11291 published to the National Vulnerability Database
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11291
Vulnerability Analysis
The vulnerability resides in the Android Autofill code path inside Chrome. Autofill must enforce strict origin boundaries because it stores and retrieves sensitive form data such as addresses, payment details, and credential hints. The flawed implementation does not consistently validate the origin of the page or frame requesting autofill data.
An attacker hosting a crafted HTML page can place form fields or frames that trick the Autofill engine into associating them with a different origin. When the user interacts with the page, Autofill operations leak across the origin boundary. This breaks the foundational same-origin policy that web applications rely on for isolation.
The attack requires the victim to load the attacker-controlled page and perform an interaction that triggers Autofill. No authentication is required and the attack proceeds over the network.
Root Cause
The root cause is improper origin validation, classified under CWE-346. The Autofill implementation on Android relies on context that an attacker can manipulate from a single crafted document. Without strict origin comparison at the point of data resolution, autofill data tied to one origin can be surfaced to another.
Attack Vector
The attack vector is network-based with required user interaction. An attacker lures the victim to a malicious site or compromised page rendered in Chrome for Android. The crafted HTML embeds form elements or framed contexts designed to confuse the Autofill origin check. When the user activates an autofill suggestion, the data crosses origin boundaries.
No verified proof-of-concept code is published for this issue. Technical details are tracked in the Chromium Issue Tracker entry and the Chrome Releases announcement.
Detection Methods for CVE-2026-11291
Indicators of Compromise
- Chrome for Android clients reporting versions earlier than 149.0.7827.53 in user-agent telemetry or mobile device management inventory.
- Outbound requests from mobile devices to unfamiliar domains immediately followed by form submissions containing autofill-style data.
- User reports of autofill suggestions appearing on unexpected or unrelated sites.
Detection Strategies
- Inventory mobile browser versions across the fleet and flag any Chrome for Android build below 149.0.7827.53.
- Inspect web proxy and DNS logs for access to suspicious domains hosting HTML pages that aggressively prompt for form input.
- Correlate mobile EDR telemetry with browser version data to prioritize devices that have not received the Chrome update.
Monitoring Recommendations
- Enable MDM compliance rules that require minimum Chrome versions on managed Android devices.
- Monitor for unusual cross-site autofill behavior reported by users and treat repeated complaints as a triage signal.
- Track Chrome Stable channel release notes to align internal patch baselines with upstream fixes.
How to Mitigate CVE-2026-11291
Immediate Actions Required
- Update Google Chrome for Android to version 149.0.7827.53 or later through the Google Play Store.
- Push the update through enterprise mobility management for managed Android fleets.
- Notify users to avoid using Autofill on untrusted sites until the update is installed.
Patch Information
Google addressed the issue in Chrome 149.0.7827.53 on the Stable channel. See the Chrome Releases stable channel update for the official announcement and the Chromium Issue Tracker entry for the underlying bug record. Apply the vendor patch rather than relying on workarounds.
Workarounds
- Disable Chrome Autofill for addresses, payment methods, and passwords on Android until the update is applied.
- Restrict browsing on unpatched devices to trusted, business-required sites using mobile threat defense policies.
- Educate users to dismiss autofill prompts that appear on unfamiliar pages or in unexpected form fields.
# Verify the installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should report 149.0.7827.53 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
