VulnSocial

CVE-2026-11278Disclosure(google / android)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch google android systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

google CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-346

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • android
  • chrome

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-06-05); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
google
Products
androidchrome

1 version affected across 2 products

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-06-05: 2Mentions · 2026-06-10: 1Patch / Workaround · 2026-06-10: 1Technical Details · 2026-06-05: 2Technical Details · 2026-06-10: 106-0506-10
Signal classification3 categories
Disclosure
133.3%
General
133.3%
Patch
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-06-052
Disclosure1General1
2026-06-101
Patch1
Full discourse3 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-11278 Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML pa… https://www.cve.org/CVERecord?id=CVE-2026-11278

    Post summary

    The post provides a brief disclosure of CVE-2026-11278, describing a local cross‑origin data leak vulnerability in Chrome CustomTabs, with no evidence of exploitation, patch information, or PoC details.

    00010224
    57.6K followersView on X
  • WindowsForum@windowsforum
    Patch

    🪟 Chrome Custom Tabs info leak means your “trusted browser” is basically shared infrastructure for every app’s secrets. IT patch fast or stop pretending tabs are harmless. #Windows #Microsoft #Chrome #Android #CVE https://windowsforum.com/threads/cve-2026-11278-chrome-android-custom-tabs-info-leak-what-it-teams-should-do.424774/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #BrowserSecurity #Cve2026 #ChromeAndroid https://t.co/k52gV6pYKw

    Post summary

    The tweet highlights CVE‑2026‑11278 as an info‑leak via Chrome Custom Tabs, urging IT departments to apply a patch quickly, but it does not provide exploit code or evidence of active attacks.

    0000032
    1.2K followersView on X
  • Infoflowcloud@infoflowcloud
    General

    🚨*CVE* CVE-2026-11278 Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin data via a crafted HTML pa… https://www.cve.org/CVERecord?id=CVE-2026-11278 ----- Traducción: CVE-2026-11278 Imp… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2026‑11278, describing a local attacker leaking cross‑origin data in older Chrome Android versions, without mentioning PoC, exploit code, active exploitation, or patch details.

    0000045
    79 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
OSgoogleandroid---
Appgooglechrome---

Explore more

Back to dashboardgoogle CVEsandroid vulnerabilities