CVE-2026-79089 in Chrome
Summary
by MITRE • 08/26/2026
Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as a race condition within the Transactions Platform of Google Chrome on Android prior to version 152.0.7977.65 represents a subtle but significant flaw in how the browser handles concurrent operations related to financial transactions and system access controls. This issue stems from a timing discrepancy where multiple threads or processes interact with shared resources without proper synchronization mechanisms, allowing an attacker to manipulate the state of the application during critical security checks. The Chromium project has classified this vulnerability as having low severity due to its reliance on specific environmental conditions for exploitation rather than inherent flaws in core cryptographic protocols or memory management that typically lead to remote code execution.
The technical nature of a race condition involves a scenario where the behavior of software depends on the sequence or timing of uncontrollable events, such as thread scheduling by the operating system kernel. In this context, the Transactions Platform likely manages sensitive user data and interacts with Android's permission model to ensure that financial operations are authorized correctly. When an HTML page is crafted specifically to trigger these concurrent actions, it can exploit the window between a security check being initiated and its completion. By carefully timing requests or state changes, an attacker can cause the system to bypass access restrictions intended to limit what web content can do on behalf of the user. This type of flaw is often categorized under CWE-362, which defines concurrent execution using shared resources with improper synchronization as a common weakness leading to security vulnerabilities.
The operational impact of this vulnerability centers on privilege escalation within the browser sandbox and potential unauthorized access to system-level features or sensitive data associated with financial transactions. Although the severity is rated low because it requires social engineering, the ability for a remote attacker to bypass system access restrictions poses a risk to user privacy and financial security. An adversary would need to lure a victim into visiting a malicious website designed to exploit this race condition. Once triggered, the crafted HTML page could potentially extract sensitive information or perform unauthorized actions that should have been blocked by Chrome's permission model. This aligns with ATT&CK technique T1059, Command and Scripting Interpreter, specifically through web browsers, as it involves using a legitimate application to execute malicious logic that circumvents intended security boundaries.
Mitigation strategies for this vulnerability primarily involve updating the Google Chrome browser on Android devices to version 152.0.7977.65 or later, where the race condition has been addressed through improved synchronization of transaction-related operations and stricter enforcement of access controls during concurrent execution paths. Users should ensure that automatic updates are enabled for their browsers to receive security patches promptly. Additionally, employing browser extensions that block suspicious scripts or limiting permissions granted to websites can reduce the attack surface available to social engineering campaigns. Security awareness training remains critical in this context, as users must be educated about the risks of visiting untrusted sites and interacting with unexpected prompts or behaviors on financial platforms, thereby reducing the likelihood of successful exploitation even if a vulnerability exists.