CVE-2026-11297

HighCVSS 7.7/10Last modified Jul 23, 2026

Description

Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Google	Chrome	>= 149.0.7827.53, < 149.0.7827.53

References

https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/502502017Permissions Required

Timeline

Published: Jun 5, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1129707.0Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129717.0Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.CVE-2026-1129727.5Integer overflow or wraparound in Windows SMB Server allows an authorized attacker to execute code over a network.CVE-2026-1129737.1Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally.CVE-2026-1129745.5Improper access control in Microsoft Account allows an authorized attacker to perform tampering locally.CVE-2026-1129755.3Untrusted pointer dereference in Windows Link-Layer Discovery Protocol (LLDP) allows an unauthorized attacker to deny service over an adjace CVE-2026-1129767.0Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129775.5Improper privilege management in Windows Deployment Services allows an authorized attacker to disclose information locally.CVE-2026-1129787.8Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.CVE-2026-1129795.5Weak authentication in Windows State Repository Service allows an authorized attacker to perform tampering locally.CVE-2026-112984.3Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origi CVE-2026-1129806.7Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.