This vulnerability arises from insufficient enforcement of security policies within the CustomTabs component of Google Chrome on Android before version 149.0.7827.53. An attacker can exploit this weakness by crafting a malicious HTML page that causes cross-origin data leakage. The issue is recognized by the Chromium security team with a low severity rating. The vendor advisory linked does not explicitly confirm patch availability or remediation details. The affected product is Google Chrome on Android, and the vulnerability is published and assigned CVE-2026-11247.

The impact is limited to potential leakage of cross-origin data via the CustomTabs feature in affected Chrome versions on Android. This could expose sensitive information from other origins to an attacker-controlled page. The Chromium security team classifies this as a low severity issue, indicating limited risk or difficulty in exploitation. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome on Android to version 149.0.7827.53 or later once the update is available. Until then, no specific mitigations are detailed by the vendor.