CVE-2026-79213 in Chrome
Summary
by MITRE • 08/26/2026
Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an incorrect authorization flaw within the WebAppInstalls component of Google Chrome for Android represents a significant breach in the application's privilege management logic. This issue, which existed prior to version 152.0.7977.65, stems from insufficient checks during the process where web applications are installed or interact with system-level permissions on the device. In modern mobile operating systems like Android, the distinction between standard browser context and privileged application contexts is critical for maintaining security boundaries. When a user initiates an installation of a Progressive Web App or interacts with features that require elevated privileges, the browser must strictly validate whether the requesting entity has legitimate authority to perform these actions. The flaw in this specific implementation allowed the authorization checks to be bypassed, effectively treating untrusted input as authorized system commands without proper verification of the caller's identity or intent.
From a technical perspective, this vulnerability falls under the category of improper access control, specifically aligning with CWE-269: Improper Privilege Management and CWE-862: Missing Authorization. The core issue lies in the failure to enforce security policies that restrict certain operations to authorized users or processes only. By crafting an HTML page containing specific scripts or embedded elements designed to trigger the WebAppInstalls functionality, a remote attacker could manipulate the browser into executing actions that should have been blocked by the operating system's access restrictions. This bypass allows the malicious content to operate with higher privileges than intended, potentially accessing sensitive user data, modifying device settings, or installing unauthorized components without explicit and verified consent from the device owner.
The operational impact of this vulnerability is substantial because it enables remote code execution scenarios that do not require physical access to the target device. An attacker can distribute a malicious URL through phishing emails, compromised websites, or other social engineering vectors. Once a victim visits the crafted page using an affected version of Chrome on Android, the browser's internal logic fails to reject the unauthorized request. This leads to a state where the web application gains capabilities beyond its sandboxed environment. Depending on the specific privileges involved in the WebAppInstalls module at that time, this could result in data exfiltration, persistence mechanisms being established on the device, or further exploitation of other system components by leveraging the elevated access gained through this initial bypass.
This type of vulnerability is often associated with ATT&CK technique T1059: Command and Scripting Interpreter if it leads to script execution, or more broadly under Initial Access vectors like T1189: Drive-by Compromise. The ability to bypass system access restrictions via a web page highlights the risks inherent in complex browser architectures where multiple subsystems interact with the underlying operating system APIs. Without strict separation of duties and rigorous validation at every step of the installation and permission-granting process, attackers can exploit these intersections to escalate privileges or perform unauthorized actions that compromise user privacy and device integrity.
Mitigation for this vulnerability requires immediate action by updating Google Chrome on Android devices to version 152.0.7977.65 or later, where the authorization checks have been corrected to properly validate requests against system access policies. Users should ensure that automatic updates are enabled to receive security patches promptly as they become available. Additionally, organizations deploying mobile devices in enterprise environments should enforce strict browser update policies and consider using Mobile Device Management solutions to monitor for outdated software versions. Security awareness training is also recommended to help users recognize potential phishing attempts involving malicious links or suspicious web content that might attempt to exploit such vulnerabilities before a patch is applied.