Google’s CVE-2026-11034 entry describes a medium-severity Chrome-on-Android flaw fixed before version 149.0.7827.53, where insufficient validation in Tab Group Sync could let a remote attacker inject script or HTML through malicious network traffic. The oddity is not the bug class; universal...