CVE-2026-91717 in Chrome
Summary
by MITRE • 09/16/2026
Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified as missing authorization within the Chromium engine used by Google Chrome for Android represents a significant flaw in access control mechanisms, specifically affecting versions prior to 153.0.8010.47. This issue stems from an insufficient check of user privileges when handling requests initiated by applications installed on the same device. In mobile operating systems like Android, apps typically operate within isolated sandboxes to prevent unauthorized data exchange; however, this vulnerability indicates that Chrome failed to strictly enforce these boundaries when interacting with co-installed applications. A local attacker who has successfully deployed a malicious or compromised application onto the victim's device can exploit this gap in authorization logic to bypass intended security restrictions.
From a technical perspective, the core of the flaw lies in how Chrome processes inter-process communication and intent handling from other apps on the system. When an app attempts to interact with Chrome through specific APIs or intents, the browser should verify that the requesting application has legitimate permission to access certain resources or trigger specific actions. In this case, the verification step was either absent or incorrectly implemented, allowing any co-installed app to send commands or requests that Chrome would execute without proper validation of the sender's identity or rights. This lack of strict authorization enables a lower-privileged entity to perform operations typically reserved for higher-privileged contexts or system components, effectively elevating its capabilities within the browser environment.
The operational impact of this vulnerability is primarily centered on information disclosure and potential data exfiltration. Because the attacker can leverage co-installed apps to interact with Chrome without authorization, they are able to retrieve sensitive user data such as browsing history, saved passwords, cookies, autofill details, or cached web content that should remain private. This scenario poses a severe risk to user privacy and security, particularly in shared device environments or on devices where users may have inadvertently installed malicious software disguised as legitimate utilities. The ability of an attacker to obtain this sensitive information can lead to account takeovers, identity theft, and further exploitation of compromised credentials across other services.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, as the system failed to ensure that only authorized actors could perform specific actions within Chrome. Furthermore, it relates to ATT&CK technique T1059, specifically subtechniques involving command and script interpretation or API abuse on mobile platforms, where an attacker uses legitimate software features for malicious purposes. The exploitation vector is classified as local, requiring physical access or the ability to install apps on the target device, which limits its remote exploitability but increases risk in scenarios of social engineering or malware infection via sideloading.
To mitigate this vulnerability, users must update Google Chrome on their Android devices to version 153.0.8010.47 or later, where these authorization checks have been reinforced and validated by the Chromium security team. Security administrators should enforce policies that restrict app installation from unknown sources whenever possible and utilize mobile device management solutions to monitor for suspicious application behavior. Additionally, users should regularly audit installed applications and remove any software that is no longer needed or appears untrustworthy, thereby reducing the attack surface available to local adversaries seeking to exploit this specific authorization flaw in the browser engine.