Is CVE-2026-11175 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11175 being exploited in the wild.

How severe is CVE-2026-11175?

Informational severity, with a CVSS score of 4.3, published 4 June 2026.

Which products and versions are affected?

Google Chrome prior to 149.0.7827.53.

Is there a fix for CVE-2026-11175?

A patch was published on 2026-06-02: Chrome 149 stable channel update announced Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11175 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11175?

Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11175: Google Chrome for Android UI spoofing in Messages

CVE-2026-11175 · Severity: info · CVSS 4.3 · Published 2026-06-04

A security issue in Google Chrome for Android could allow a malicious website to display deceptive information in the browser's messaging interface. This type of flaw, known as UI spoofing, can be used to trick users into performing unintended actions or believing they are interacting with a legitimate service. Users are advised to update their Chrome application to the latest version to resolve this issue.

Technologies: Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-11175 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11175 being exploited in the wild.
How severe is CVE-2026-11175?: Informational severity, with a CVSS score of 4.3, published 4 June 2026.
Which products and versions are affected?: Google Chrome prior to 149.0.7827.53.
Is there a fix for CVE-2026-11175?: A patch was published on 2026-06-02: Chrome 149 stable channel update announced Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11175 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11175?: Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An incorrect security UI implementation in the Messages component of Google Chrome on Android allowed a remote attacker to perform UI spoofing. By enticing a user to visit a specially crafted HTML page, an attacker could manipulate the browser's interface to present misleading information to the user. This vulnerability is categorized as a UI spoofing flaw (CWE-1021) and was addressed in version 149.0.7827.53. The attack requires user interaction (visiting the malicious site) but no special privileges.

Affected products

Google Chrome for Android prior to 149.0.7827.53

Timeline

2026-06-02: patched: Chrome 149 stable channel update announced
2026-06-04: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.