# CVE-2026-11297: Google Chrome for Android navigation bypass in Reader Mode

Source: https://junglewise.ai/threats/cve-2026-11297-google-chrome-for-android-navigation-bypass-in-reader-mode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-11297 · Severity: info · CVSS 2 · Published 2026-06-05

A security issue in Google Chrome for Android's Reader Mode could allow a malicious file to bypass standard navigation restrictions. Reader Mode is a feature that simplifies web pages for easier reading. In practice, a local attacker could use this flaw to force the browser to navigate to unauthorized locations or bypass security boundaries intended to keep different web content separated.

Technologies: [Google Chrome for Android](https://junglewise.ai/threats/technologies/chrome-for-android). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2026-11297 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11297 being exploited in the wild.

**How severe is CVE-2026-11297?** Informational severity, with a CVSS score of 2, published 5 June 2026.

**Which products and versions are affected?** Google Chrome for Android prior to 149.0.7827.53.

**Is there a fix for CVE-2026-11297?** A patch was published on 2026-06-02: Chrome 149 promoted to stable channel Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11297 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-11297?** Check whether you run Google Chrome for Android at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input validation vulnerability (CWE-20) exists in the Reader Mode component of Google Chrome for Android. The flaw stems from insufficient validation of untrusted input when processing files within Reader Mode. A local attacker can exploit this by providing a specially crafted malicious file to bypass navigation restrictions. This could potentially allow the attacker to circumvent security boundaries that normally restrict page transitions or origin-based access. The vulnerability is addressed in version 149.0.7827.53.

## Affected products

- Google Chrome for Android prior to 149.0.7827.53

## Timeline

- 2026-06-02: patched: Chrome 149 promoted to stable channel
- 2026-06-05: disclosed: NVD publication date

## References

- [https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html](https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html)
- [https://issues.chromium.org/issues/502502017](https://issues.chromium.org/issues/502502017)

## Related threats

- [Google Chrome WebView sandbox escape via improper input validation](https://junglewise.ai/threats/cve-2026-17741-google-chrome-webview-sandbox-escape-via-improper-input)
- [Google Chrome for Android use after free in WebView](https://junglewise.ai/threats/cve-2026-13037-google-chrome-for-android-use-after-free-in-webview)
- [Google Chrome WebView sandbox escape on Android](https://junglewise.ai/threats/cve-2026-12438-google-chrome-webview-sandbox-escape-on-android)
- [Google Chrome for Android use after free in Messages](https://junglewise.ai/threats/cve-2026-11163-google-chrome-for-android-use-after-free-in-messages)
- [Google Chrome for Android privilege escalation in Custom Tabs](https://junglewise.ai/threats/cve-2026-11035-google-chrome-for-android-privilege-escalation-in-custom-tabs)