CVE-2026-79086 in Chrome
Summary
by MITRE • 08/26/2026
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as missing authorization within the Custom Tabs implementation in Google Chrome for Android represents a significant lapse in access control mechanisms that can be exploited by malicious applications installed on the same device. This flaw, present in versions prior to 152.0.7977.65, stems from an insufficient validation of permissions when handling requests initiated through the Custom Tabs API. In standard mobile operating system architectures, particularly Android, different applications operate within isolated sandboxes to prevent unauthorized data access. However, this specific implementation failure allows a co-installed application to bypass expected security boundaries by leveraging the browser's elevated privileges or trust relationships without proper authorization checks.
From a technical perspective, Custom Tabs are designed to allow third-party apps to open web pages in Chrome while maintaining some level of integration with the host app. The vulnerability arises because the system did not adequately verify whether the requesting application had legitimate authority to access specific sensitive information or perform actions that could expose user data. This lack of rigorous authorization checking creates a pathway for local attackers who have already gained foothold on the device through malware, spyware, or other malicious software distributed via unofficial channels or compromised app stores. By exploiting this gap, an attacker can trick Chrome into revealing session cookies, browsing history fragments, or other private user data that should remain confined to the browser's secure context.
The operational impact of this vulnerability is primarily centered on privacy violations and potential credential theft. Since the attack vector requires a local installation, it targets devices where users may have inadvertently installed malicious applications disguised as legitimate utilities or games. Once executed, the exploit can extract sensitive information such as authentication tokens stored in browser cookies, which could lead to account takeovers if those accounts are used for critical services like banking or email. Furthermore, exposure of browsing history and visited URLs can compromise user anonymity and reveal personal interests or health-related searches, leading to social engineering attacks or blackmail scenarios. The severity is classified as medium by the Chromium security team because while it does not allow direct remote code execution, it facilitates significant data exfiltration from a trusted application context.
This issue aligns with CWE-269, which describes Improper Privilege Control, specifically where an actor obtains privileges that are not intended for them due to insufficient authorization checks. In the context of the MITRE ATT&CK framework, this vulnerability supports techniques related to Collection and Exfiltration over C2 channels if combined with other malware components, but fundamentally it represents a Local Application Harvesting scenario under T1059 or similar data access patterns. The failure lies in the application's inability to distinguish between authorized and unauthorized callers within its own process space when interacting with system-level browser features.
Mitigation for this vulnerability requires immediate updates to Google Chrome on Android devices to version 152.0.7977.65 or later, where these authorization checks have been reinforced. Users should ensure that automatic updates are enabled to receive security patches promptly. Additionally, device owners must exercise caution when installing applications from sources other than the official Google Play Store, as this vulnerability specifically relies on a co-installed app being present on the system. Implementing strict application permission policies and using mobile endpoint protection solutions can further reduce the risk of malicious apps gaining the initial foothold necessary to attempt exploitation of such browser-side flaws. Regular auditing of installed applications and revoking unnecessary permissions for high-privilege apps like browsers can also serve as a defensive measure against this class of local privilege escalation attacks.