CVE-2026-78949 in Chrome
Summary
by MITRE • 08/25/2026
Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability identified as an observable discrepancy within the CustomTabs implementation in Google Chrome for Android prior to version 152.0.7977.65 represents a significant breach of browser isolation principles. This flaw allows a local attacker, specifically through a co-installed application on the same device, to access cross-origin data that should remain strictly confined within its own origin context. The issue stems from an inconsistency in how Chrome handles session state and navigation boundaries when interacting with CustomTabs, which are designed to provide a seamless user experience by allowing apps to open web pages without leaving the host application environment. When this boundary is compromised due to improper validation or state management errors, it creates a pathway for unauthorized data exfiltration from one origin to another within the same browser session.
From a technical perspective, the root cause lies in the failure of Chrome's security model to properly enforce separation between different origins when CustomTabs are utilized by third-party applications. In standard web browsing scenarios, browsers rely on strict Same-Origin Policies (SOP) and Cross-Origin Resource Sharing (CORS) mechanisms to prevent malicious sites from accessing sensitive data such as cookies, local storage, or DOM content belonging to other domains. However, in the context of Android's CustomTabs API, if a co-installed app can manipulate the intent parameters or exploit race conditions during tab initialization, it may trick Chrome into treating requests from an untrusted origin as part of a trusted session. This effectively bypasses the intended isolation layers, allowing the attacker to read sensitive information that was previously inaccessible due to cross-origin restrictions.
The operational impact of this vulnerability is primarily centered on privacy and data integrity for Android users who rely on Chrome for secure browsing activities involving financial transactions, personal communications, or corporate credentials. An attacker with local access via a maliciously installed app could potentially harvest session cookies, authentication tokens, or other persistent storage elements belonging to high-value targets such as banking portals or email services. This capability undermines the fundamental trust model of web browsers and poses a severe risk to user confidentiality. Although the severity is classified as medium by Chromium security standards, the potential for widespread data leakage across multiple sensitive domains makes this a critical concern for enterprise environments and individual users alike who prioritize digital privacy.
This vulnerability aligns with CWE-200, which categorizes information exposure vulnerabilities where an attacker gains access to restricted resources without authorization. Furthermore, it relates to ATT&CK technique T1537, involving communication through removable media or shared storage in mobile contexts, although more accurately mapped to local privilege escalation via application sandbox escape mechanisms found in Android ecosystems like CWE-269 (Improper Privilege Management) and CWE-829 (Inclusion of Functionality from Untrusted Control). The flaw highlights the complexities inherent in integrating native app functionalities with web-based security models.
To mitigate this risk, users are strongly advised to update Google Chrome on their Android devices immediately to version 152.0.7977.65 or later, where these boundary checks and session isolation protocols have been hardened. Additionally, administrators should enforce strict application installation policies within organizational mobile device management systems to prevent unauthorized co-installed apps from gaining access to browser data stores. Users can further reduce exposure by regularly auditing installed applications for suspicious permissions and utilizing Chrome's built-in security features such as Safe Browsing and site-specific settings that restrict cross-site tracking and cookie storage behaviors.