CVE-2026-79124 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Intents in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the Intent handling mechanisms of Google Chrome for Android, specifically in versions prior to 152.0.7977.65, represents a significant privacy risk stemming from improper data isolation between web contexts and native application interfaces. This flaw allows a remote attacker to exploit the interaction model between the browser engine and the underlying operating system's intent resolution system. By crafting a malicious HTML page that triggers specific Intent actions, an adversary can induce Chrome to expose sensitive internal state information or user-specific data that should remain confined within the secure browsing context. The severity is classified as Low by Chromium security standards, indicating that while the exploitability requires some level of social engineering or precise timing, the potential for unauthorized data disclosure remains a critical concern for mobile users who rely on the browser for accessing personal accounts and sensitive services.
From a technical perspective, Android Intents serve as the primary messaging object used to request an action from another application component. When Chrome processes certain web-based triggers that map to native intents, it must carefully sanitize the data passed through these channels. The vulnerability arises when this sanitization process fails to adequately strip or restrict access to sensitive metadata associated with the current browsing session. An attacker hosting a malicious webpage can construct JavaScript payloads that invoke specific intent filters configured on the device. If the browser does not properly validate the scope of information exposed during this handoff, details such as cookies, local storage contents, or even fragments of previously visited URLs may be inadvertently passed to third-party applications registered to handle those intents. This bypasses standard web sandboxing protections because the data exits the controlled environment of the renderer process and enters the broader Android application ecosystem where different security boundaries apply.
The operational impact of this vulnerability centers on privacy erosion rather than direct system compromise or code execution. A successful exploitation could allow an attacker to gather intelligence about a user's browsing habits, potentially identifying financial institutions accessed, health-related searches performed, or other private activities. This information leakage can facilitate further attacks such as targeted phishing campaigns where the attacker uses known context to craft highly convincing fraudulent messages. Furthermore, if sensitive tokens or session identifiers are leaked via this vector, it could lead to account takeover scenarios depending on how those values are handled by receiving applications. The risk is particularly acute for users who have installed multiple third-party apps that register broad intent filters, increasing the attack surface available to an adversary attempting to harvest data through crafted web content.
Mitigation strategies primarily involve updating Google Chrome to version 152.0.7977.65 or later, where these Intent handling routines have been patched to enforce stricter data isolation and validation checks. Users should ensure that automatic updates are enabled for the browser application to receive security patches promptly as they become available. Additionally, from a defensive posture perspective, users can mitigate risk by reviewing installed applications and revoking permissions for apps that request access to sensitive system features or broad intent handling capabilities without clear necessity. Security awareness training is also recommended to help users recognize suspicious links in emails or messages that might attempt to trigger such browser-based exploits. Monitoring device behavior for unexpected app launches following web interactions can serve as an indicator of compromise, although the low severity suggests this vector is more likely used for stealthy data collection than overt disruption.
This vulnerability aligns with CWE-200, which defines Information Exposure, specifically falling under categories related to exposure of sensitive information through improper control of configuration or interface behavior. In terms of offensive security frameworks like MITRE ATT&CK, this technique relates to T1537, Transfer Data to Cloud Account via Non-Standard Protocol, although adapted for local inter-process communication on mobile platforms. It also touches upon aspects of data exfiltration where the browser acts as a conduit for leaking stateful information out of its sandboxed environment. Understanding these mappings helps security teams categorize similar issues across different software ecosystems and apply consistent remediation protocols based on established industry standards for handling unintended data disclosure in complex application architectures involving multiple trust boundaries.