# CVE-2026-11175: Google Chrome for Android UI spoofing in Messages

Source: https://junglewise.ai/threats/cve-2026-11175-google-chrome-for-android-ui-spoofing-in-messages  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-11175 · Severity: info · CVSS 4.3 · Published 2026-06-04

A security issue in Google Chrome for Android could allow a malicious website to display deceptive information in the browser's messaging interface. This type of flaw, known as UI spoofing, can be used to trick users into performing unintended actions or believing they are interacting with a legitimate service. Users are advised to update their Chrome application to the latest version to resolve this issue.

Technologies: [Google Chrome](https://junglewise.ai/threats/technologies/chrome). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-11175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11175 being exploited in the wild.

**How severe is CVE-2026-11175?** Informational severity, with a CVSS score of 4.3, published 4 June 2026.

**Which products and versions are affected?** Google Chrome prior to 149.0.7827.53.

**Is there a fix for CVE-2026-11175?** A patch was published on 2026-06-02: Chrome 149 stable channel update announced Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11175 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-11175?** Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An incorrect security UI implementation in the Messages component of Google Chrome on Android allowed a remote attacker to perform UI spoofing. By enticing a user to visit a specially crafted HTML page, an attacker could manipulate the browser's interface to present misleading information to the user. This vulnerability is categorized as a UI spoofing flaw (CWE-1021) and was addressed in version 149.0.7827.53. The attack requires user interaction (visiting the malicious site) but no special privileges.

## Affected products

- Google Chrome for Android prior to 149.0.7827.53

## Timeline

- 2026-06-02: patched: Chrome 149 stable channel update announced
- 2026-06-04: disclosed: CVE published to NVD

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html)
- [https://issues.chromium.org/issues/502368088](https://issues.chromium.org/issues/502368088)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)