CVE-2026-11145 describes a race condition in the Geolocation component of Google Chrome on Android platforms before version 149.0.7827.53. This flaw enables a remote attacker to leak data across origins by exploiting timing issues in the handling of geolocation requests within a crafted HTML page. The vulnerability has a medium severity rating and a CVSS 3.1 score of 5.3, indicating a moderate impact on confidentiality without affecting integrity or availability. No official remediation level or patch is explicitly stated in the provided data, but the affected versions are those prior to 149.0.7827.53.

The vulnerability allows remote attackers to bypass same-origin policy restrictions and leak sensitive cross-origin data through a race condition in the geolocation feature. This impacts user privacy by exposing location-related information to unauthorized web origins. There is no indication of integrity or availability impact. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The provided vendor advisory URL points to a Chrome stable channel update announcement, which should be reviewed to confirm if a fix has been released. Until an official fix is confirmed, users should consider updating to the latest Chrome version on Android when available to mitigate this issue.