CVE-2026-79055 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Sharing component of Google Chrome for Android prior to version 152.0.7977.65 represents a significant privacy risk that stems from insufficient isolation between browser contexts and co-installed applications on the device. This flaw allows local attackers, who typically gain access through social engineering tactics such as convincing users to install malicious or compromised third-party apps, to extract sensitive data shared via Chrome’s native sharing mechanisms. The core technical issue lies in how the operating system handles intent filters and permission checks when an application requests to share content with another app. In vulnerable versions of Chrome, the browser fails to adequately restrict which co-installed applications can receive or access this shared information, effectively bypassing expected privacy boundaries that should prevent unauthorized data exfiltration by non-trusted parties.
From a technical perspective, Android’s sharing infrastructure relies heavily on explicit intents and permission grants to ensure that only authorized recipients can process shared content such as URLs, text snippets, or media files. When Chrome initiates a share operation, it generates an intent containing the payload and potential metadata about the source page. The vulnerability arises because the browser does not sufficiently validate whether the target application has legitimate authorization to receive this specific type of data in the context of the user’s current session. This oversight enables a malicious app that is already present on the device or installed via social engineering to intercept, log, or forward sensitive information like browsing history fragments, authentication tokens embedded in URLs, or private text content without triggering standard security warnings or requiring additional explicit consent from the user for each specific data transfer event.
The operational impact of this vulnerability is primarily centered around privacy violations and potential credential theft through indirect means. An attacker leveraging social engineering to install a rogue application can exploit this flaw to silently harvest sensitive information that users assume remains confined within the browser environment. For instance, if a user shares a URL containing session cookies or personal identifiers with any app listed in their sharing menu, even inadvertently selecting a malicious option due to deceptive naming or interface manipulation, the data is transmitted to the attacker’s control. This can lead to account takeovers, identity theft, or further targeted attacks based on the harvested intelligence. Although classified as low severity by Chromium security standards, the ease of exploitation via social engineering significantly amplifies its real-world risk profile, particularly among non-technical users who may not distinguish between legitimate and malicious sharing targets.
This vulnerability aligns with CWE-200, which categorizes information exposure vulnerabilities where sensitive data is accessible to unauthorized actors without proper access controls. Furthermore, it maps to the MITRE ATT&CK framework under techniques related to Collection via Input Capture or Data from Information Repositories, specifically reflecting how attackers leverage installed software on a victim’s device to gather intelligence. The attack vector involves local privilege escalation through trust relationships between apps rather than direct system exploitation, highlighting the importance of strict sandboxing and intent validation in mobile operating systems.
Mitigation strategies focus primarily on updating the browser to version 152.0.7977.65 or later, where these sharing restrictions have been tightened to ensure that only explicitly trusted applications can receive shared content from Chrome sessions. Users should also exercise caution when selecting targets for sharing operations, verifying the legitimacy of co-installed apps before granting them access to sensitive data. Additionally, implementing mobile device management policies that restrict app installation sources and regularly auditing installed permissions can reduce the attack surface available to social engineers aiming to deploy malicious software capable of exploiting this flaw. Regular security awareness training regarding safe browsing and sharing practices remains critical in preventing successful exploitation of such privacy-centric vulnerabilities.