Is CVE-2026-11215 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11215 being exploited in the wild.

How severe is CVE-2026-11215?

Informational severity, with a CVSS score of 4.3, published 4 June 2026.

Which products and versions are affected?

Google Chrome prior to 149.0.7827.53.

Is there a fix for CVE-2026-11215?

A patch was published on 2026-06-02: Chrome 149 promoted to stable channel. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-11215 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-11215?

Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11215: Google Chrome for Android domain spoofing in Cronet

CVE-2026-11215 · Severity: info · CVSS 4.3 · Published 2026-06-04

A vulnerability in the Cronet networking component of Google Chrome on Android could allow a remote attacker to perform domain spoofing. By using a specially crafted domain name, an attacker could trick users into believing they are visiting a legitimate website when they are actually on a malicious one. This could lead to phishing attacks where sensitive user information is stolen by impersonating trusted services.

Technologies: Google Chrome. Vendors: Google.

Quick answers

Is CVE-2026-11215 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11215 being exploited in the wild.
How severe is CVE-2026-11215?: Informational severity, with a CVSS score of 4.3, published 4 June 2026.
Which products and versions are affected?: Google Chrome prior to 149.0.7827.53.
Is there a fix for CVE-2026-11215?: A patch was published on 2026-06-02: Chrome 149 promoted to stable channel. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11215 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-11215?: Check whether you run Google Chrome at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An inappropriate implementation vulnerability exists in Cronet, the network stack used by Google Chrome on Android. The flaw is triggered when the browser processes a specially crafted domain name, allowing a remote attacker to spoof the domain displayed to the user. This is categorized as a domain spoofing vulnerability where the root cause lies in how the component validates or renders specific character sets or domain structures. An attacker can exploit this by enticing a user to visit a malicious link, potentially bypassing security indicators. The issue is resolved in Google Chrome for Android version 149.0.7827.53.

Affected products

Google Chrome for Android prior to 149.0.7827.53

Timeline

2026-06-02: patched: Chrome 149 promoted to stable channel.
2026-06-04: disclosed: CVE published.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.