Is CVE-2026-11167 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11167 being exploited in the wild.

How severe is CVE-2026-11167?

Informational severity, published 4 June 2026.

Which products and versions are affected?

Google Chrome prior to 149.0.7827.53; Google WebView prior to 149.0.7827.53.

Is there a fix for CVE-2026-11167?

A patch was published on 2026-06-02: Chrome 149 promoted to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11167 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11167?

Check whether you run Google Chrome or Google WebView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11167: Google Chrome for Android sandbox escape in WebView

CVE-2026-11167 · Severity: info · Published 2026-06-04

A vulnerability in Google Chrome and WebView on Android could allow a malicious website to escape the browser's security sandbox. This sandbox is designed to keep web content isolated from the rest of the device; if bypassed, an attacker who has already compromised the browser's rendering process could potentially gain broader access to the underlying operating system. This could lead to unauthorized access to device data or further system compromise.

Technologies: Google Chrome, Google WebView. Vendors: Google.

Quick answers

Is CVE-2026-11167 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11167 being exploited in the wild.
How severe is CVE-2026-11167?: Informational severity, published 4 June 2026.
Which products and versions are affected?: Google Chrome prior to 149.0.7827.53; Google WebView prior to 149.0.7827.53.
Is there a fix for CVE-2026-11167?: A patch was published on 2026-06-02: Chrome 149 promoted to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11167 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11167?: Check whether you run Google Chrome or Google WebView at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is classified as an 'Inappropriate Implementation' within the WebView component of Google Chrome for Android. The flaw allows a remote attacker to perform a sandbox escape, provided they have already achieved a compromise of the renderer process (typically through a separate vulnerability). The attack is executed via a specially crafted HTML page. By escaping the sandbox, the attacker moves from the restricted rendering environment to the more privileged browser process or the Android operating system. The issue is addressed in version 149.0.7827.53.

Affected products

Google Chrome for Android prior to 149.0.7827.53
Google WebView for Android prior to 149.0.7827.53

Timeline

2026-06-02: patched: Chrome 149 promoted to stable channel
2026-06-04: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.