CVE-2026-78936 in Chrome
Summary
by MITRE • 08/25/2026
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as an observable discrepancy within the CustomTabs implementation of Google Chrome for Android prior to version 152.0.7977.65 represents a significant breach in cross-origin isolation principles. This flaw allows a local attacker, specifically through a co-installed application on the same device, to access sensitive data belonging to other origins or applications that are utilizing CustomTabs functionality. The severity is classified as Medium by Chromium security standards, indicating that while exploitation requires specific conditions such as physical access or prior installation of malicious software, the potential for unauthorized data exfiltration poses a tangible risk to user privacy and application integrity.
At its core, this vulnerability stems from improper handling of origin checks within the CustomTabs API. When an Android application launches a web page via CustomTabs, it expects strict adherence to same-origin policies to prevent cross-site scripting or data leakage. However, due to the observed discrepancy in how Chrome validates these origins during certain interactions, particularly when multiple applications are involved or under specific state conditions, the browser fails to correctly isolate the browsing context. This failure enables a malicious co-installed app to inject scripts or manipulate navigation events that bypass standard security boundaries, effectively allowing it to read cookies, local storage data, or other sensitive information associated with the victim application's CustomTab session.
The operational impact of this vulnerability is primarily centered on privacy violations and potential credential theft. An attacker who has managed to install a malicious app alongside legitimate applications can exploit this flaw to harvest user-specific data without direct interaction from the end-user beyond initial installation. This could include authentication tokens, personal identifiers, or browsing history fragments that are stored within the CustomTabs session context. Since Android devices often host multiple apps with varying levels of trust and security postures, the ability for one app to窥视 another through a shared browser component undermines the fundamental sandboxing model intended by mobile operating systems and web standards alike.
From an industry standard perspective, this vulnerability aligns closely with CWE-200: Information Exposure, where sensitive information is disclosed to unauthorized actors due to improper access controls. Furthermore, it relates to CWE-942: Permissive Cross-domain Whitelist, as the flaw involves a breakdown in enforcing cross-origin restrictions within a web context embedded within a native application environment. In terms of MITRE ATT&CK mapping for mobile platforms, this behavior is consistent with techniques found under T1530: Data from Local System or potentially T1608: Link Account Creation if used to hijack sessions that link user accounts across services. The attack vector leverages the trust relationship between co-installed apps and the system browser engine, exploiting a gap in inter-process communication security boundaries.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome on Android devices to version 152.0.7977.65 or later, where these origin validation checks have been corrected. For developers utilizing CustomTabs, it is crucial to ensure that their applications do not rely solely on the browser's default security model without implementing additional application-level safeguards. This includes avoiding the storage of highly sensitive credentials in local storage accessible via web views and ensuring that any custom tabs launched are configured with appropriate flags to restrict data sharing where possible. Users should maintain up-to-date software versions and exercise caution when installing applications from untrusted sources, as this vulnerability specifically requires a co-installed app context for exploitation.