cve-2026-11108

CVE-2026-11108 is a Chrome for Android vulnerability disclosed on June 4, 2026, involving an NFC implementation flaw that could allow remote attackers to escalate privileges via a crafted HTML page. The fix was included in Chrome version 149.0.7827.53. Discussions on WindowsForum highlight confusion around the NVD's CPE mapping, which initially modeled the exposure as Chrome plus Android, while the advisory points to Chrome as the patched product. This distinction matters for enterprise patch management and risk reporting, as automated scanners often rely on CPE data before human-readable descriptions are finalized. The tag covers analysis of the vulnerability's metadata and its implications for security teams.