CVE-2026-11108 describes an inappropriate implementation in the NFC component of Google Chrome on Android devices before version 149.0.7827.53. This flaw enables a remote attacker to perform privilege escalation by delivering a specially crafted HTML page. The vulnerability has a CVSS v3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability. The issue is categorized under CWE-269 (Improper Privilege Management). There is no explicit remediation level stated in the vendor advisory, but the fixed version is 149.0.7827.53. No public exploits have been observed.

Successful exploitation allows a remote attacker to escalate privileges on an affected Android device running Google Chrome, potentially leading to full compromise of the browser environment and associated data. The CVSS vector indicates that the attack requires user interaction but no privileges or authentication, and it impacts confidentiality, integrity, and availability with high severity.

Users should update Google Chrome on Android to version 149.0.7827.53 or later to remediate this vulnerability. The vendor advisory indicates this version contains the fix. There is no indication that temporary mitigations or workarounds are available or required. No known exploits in the wild reduce immediate urgency, but patching is recommended to prevent potential exploitation.