CVE-2026-79152 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the CustomTabs component of Google Chrome for Android, specifically in versions prior to 152.0.7977.65, represents a significant breach in web origin policy enforcement. This issue stems from insufficient validation mechanisms when handling inter-process communication between different applications on the device. The core technical failure lies in the browser's inability to strictly isolate the context of a webpage launched via CustomTabs from other co-installed applications that may have legitimate or illegitimate access to certain system resources or user data. By exploiting this misconfiguration, an attacker who has installed a malicious application alongside Chrome can manipulate the intent flags or bundle extras passed during the launch process. This manipulation allows the malicious app to trick the browser into treating content from a different origin as if it originated from the trusted site being displayed within the CustomTab interface.
From a technical perspective, this flaw facilitates an unauthorized access scenario where local application boundaries are blurred. The attacker leverages the co-installed app to inject or alter data that is subsequently processed by Chrome's rendering engine under the assumption of trust due to the CustomTabs API contract. This effectively bypasses the Same-Origin Policy (SOP), a critical security mechanism designed to prevent malicious scripts on one page from obtaining access to sensitive data on another page. The vulnerability allows for potential cross-site scripting-like effects or unauthorized reading of cookies, local storage, and other session-specific information associated with the web content displayed in the CustomTab. This undermines the fundamental isolation model that protects user privacy and application integrity within mobile environments.
The operational impact of this vulnerability is primarily centered on data exfiltration and context manipulation for attacks targeting users who utilize Chrome's CustomTabs feature to open external links without leaving their current app experience. An attacker with local access, achieved through a co-installed malicious application, can potentially steal sensitive user credentials, session tokens, or personal information stored in web storage associated with the targeted website. Furthermore, this flaw could be leveraged as part of a larger attack chain to perform phishing attacks by altering the displayed content within the CustomTab window while maintaining the appearance of legitimacy from the browser's address bar and UI elements. This erosion of trust can lead users to interact with compromised interfaces under false pretenses, increasing susceptibility to social engineering tactics.
In terms of industry classification standards, this vulnerability aligns closely with CWE-269, which denotes Improper Privilege Management, as it involves an actor gaining unauthorized access or privileges by exploiting a flaw in authorization logic. It also relates to CWE-829, Inclusion of Functionality from Untrusted Control Source, given the potential for malicious code execution through manipulated inputs within the browser context. From a tactical perspective on the MITRE ATT&CK framework, this behavior is consistent with techniques involving Local Application Escalation and potentially Data Exfiltration over C2 channels if combined with other malware components. The low severity rating assigned by Chromium reflects the requirement for local installation of an app, which limits the attack surface to users who have already granted significant permissions or installed untrusted software on their devices.
Mitigation strategies focus primarily on timely patching and user education. Users should immediately update Google Chrome for Android to version 152.0.7977.65 or later, where these authorization checks have been hardened to strictly validate the origin and integrity of intents received by CustomTabs. Developers integrating CustomTabs into their applications must ensure they adhere to best practices regarding intent handling and avoid passing sensitive data in extras that could be intercepted or modified by other apps with appropriate permissions. Security administrators should enforce strict application installation policies on managed devices to prevent co-installation of untrusted software, thereby reducing the risk surface for local privilege escalation attacks. Regular security audits focusing on inter-process communication boundaries within mobile applications are also recommended to identify similar architectural weaknesses before they can be exploited.