CVE-2026-11131
A critical flaw in Google Chrome for Android allows a remote attacker who has already compromised the renderer process to escape the browser sandbox by using a crafted HTML page. The vulnerability is a use‑after‑free bug in the Autofill component. It could let an attacker run arbitrary code on the device.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Google Chrome for Android versions earlier than 149.0.7827.53, affecting Android users who have not updated their browser.
Real-world impact
An attacker could execute arbitrary code on the device, potentially taking full control of the phone and accessing personal data.
Why this severity
The CVSS score of 9.6 reflects that the flaw can be exploited remotely without authentication, requires only a crafted page, and gives the attacker full control over the system.
What to do about it
- 01Upgrade Google Chrome for Android to version 149.0.7827.53 or later.
- 02Restart the browser to ensure the update takes effect.
NVD-referenced vendor advisory
Timeline
- Jun 4, 2026 · Jun 4, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- chromereleases.googleblog.com/2026/06/stable-channel-upda…vendor advisory
- issues.chromium.org/issues/501561644permissions required