CVE-2026-11127 is a medium severity vulnerability in Google Chrome on Android affecting WebAPKs before version 149.0.7827.53. The vulnerability arises from an inappropriate implementation that enables remote attackers to conduct domain spoofing by crafting malicious WebAPKs. This could allow attackers to impersonate legitimate domains within the browser context. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. There is no vendor advisory explicitly stating a patch or remediation level, but the affected versions are prior to 149.0.7827.53, implying that updating to this version or later addresses the issue.

The vulnerability allows remote attackers to perform domain spoofing via crafted WebAPKs, potentially misleading users by impersonating legitimate domains. This impacts the integrity of the browsing experience but does not affect confidentiality or availability. No known exploits in the wild have been reported.

Updating Google Chrome on Android to version 149.0.7827.53 or later mitigates this vulnerability. Since the vendor advisory does not explicitly state the remediation level, users should apply the latest stable update available from Google to ensure protection. Patch status is inferred from the affected version information; check the official Google Chrome release notes for confirmation.