CVE-2026-79046 in Chrome
Summary
by MITRE • 08/26/2026
Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-3848 represents a critical race condition within the permission handling mechanisms of Google Chrome for Android, specifically affecting versions prior to 152.0.7977.65. This flaw resides in how the browser manages asynchronous requests and state transitions when processing web origin policies. In modern web browsers, security boundaries are enforced through strict same-origin policies that restrict how documents or scripts loaded from one origin can interact with resources from another. The race condition arises because there is a narrow time window during which permission states are being evaluated or updated asynchronously. An attacker could exploit this timing discrepancy by crafting an HTML page that triggers multiple concurrent requests for sensitive permissions, such as access to the camera, microphone, or geolocation services. By carefully synchronizing these requests with the browser's internal state updates, the malicious script can trick the engine into granting permission before the security check is fully completed or validated against the intended origin context.
From a technical perspective, this flaw aligns closely with CWE-362, which defines concurrent execution using shared resources without proper synchronization as a race condition vulnerability. The core issue lies in the lack of atomicity in the permission grant process within the Chromium engine on Android devices. When a web page requests access to a protected API, the browser typically prompts the user for consent or checks existing permissions stored locally. However, if multiple frames or scripts from different origins attempt to interact with these APIs simultaneously during the initialization phase, the race condition allows one context to inherit or bypass the permission state intended for another. This undermines the fundamental isolation model that prevents cross-site scripting and data leakage between unrelated web contexts. The severity is classified as medium by Chromium security standards because while it requires user interaction, the complexity of exploitation has been reduced through social engineering techniques that make the attack vector more accessible to non-technical users.
The operational impact of this vulnerability is significant for mobile device security and privacy. A remote attacker leveraging social engineering can craft a deceptive webpage that appears legitimate or urgent, prompting the victim to click on elements that trigger permission requests. Due to the race condition, the browser may inadvertently grant access to sensitive hardware features like the camera or microphone without proper user consent or origin validation. This allows the attacker to capture audio, video, or location data from the victim's device in real-time. The breach of web origin policy means that malicious scripts can exfiltrate this collected data to remote servers controlled by the attacker. Since mobile devices are often used for sensitive communications and financial transactions, such a breach compromises not only personal privacy but also potentially leads to identity theft or further compromise of connected accounts if session cookies or tokens are intercepted during these interactions.
Mitigation strategies primarily involve updating the browser software to version 152.0.7977.65 or later, where Google has implemented fixes that ensure atomicity in permission state transitions and enforce stricter validation checks before granting access to protected APIs. Users should enable automatic updates for Chrome on Android to ensure they receive security patches promptly. Additionally, users can mitigate risk by manually reviewing app permissions within the device settings and revoking unnecessary access to sensitive features like camera or microphone for browser applications when not in use. Security awareness training is also crucial; since this attack relies heavily on social engineering, educating users about the risks of interacting with untrusted web content and verifying the legitimacy of permission prompts can significantly reduce the likelihood of successful exploitation. Organizations should enforce mobile device management policies that restrict installation of outdated browsers and monitor for unusual network traffic patterns indicative of data exfiltration from compromised devices.
This vulnerability is categorized under MITRE ATT&CK technique T1059, which covers command and script interpretation, as it allows an attacker to execute arbitrary code within the context of a trusted application through browser exploitation. It also relates to TA0004, Impact, specifically regarding data exfiltration and unauthorized access to system resources. The fix emphasizes the importance of robust synchronization primitives in web engine development to prevent timing-based attacks that bypass security controls. By addressing this race condition, Google reinforces the integrity of the same-origin policy, ensuring that user permissions are granted only after complete verification of the requesting origin's legitimacy and context.