PatchSiren cyber security CVE debrief
CVE-2026-11226 Google CVE debrief
CVE-2026-11226 is a vulnerability in Google Chrome on Android prior to 149.0.7827.53. This issue involves Insufficient policy enforcement in PreviewTab, which could allow a remote attacker to bypass same origin policy via a crafted HTML page. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. It was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2026-11226) and last modified on [cveModifiedAt](https://nvd.nist.gov/vuln/detail/CVE-2026-11226). The vulnerability affects Google Chrome on Android. To address this issue, users should update Google Chrome to version 149.0.7827.53 or later. For more information, refer to the [vendor advisory](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html).
- Vendor
- Product
- Chrome
- CVSS
- MEDIUM 6.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-04
- Original CVE updated
- 2026-06-06
- Advisory published
- 2026-06-04
- Advisory updated
- 2026-06-06
Who should care
Users of Google Chrome on Android prior to version 149.0.7827.53.
Technical summary
Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page.
Defensive priority
MEDIUM
Recommended defensive actions
- Update Google Chrome to version 149.0.7827.53 or later.
Evidence notes
The vulnerability has been analyzed and verified by official sources.
Official resources
-
CVE-2026-11226 CVE record
CVE.org
-
CVE-2026-11226 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
-
Source reference
[email protected] - Permissions Required
CVE-2026-11226 was published on 2026-06-04T23:17:30.377Z and last modified on 2026-06-06T01:57:49.233Z.