CVE-2026-95285 in Chrome
Summary
by MITRE • 09/29/2026
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as missing authorization in Google Chrome for Android prior to version 154.0.8037.57 represents a critical failure in access control mechanisms within the WebView component, which is widely used by third-party applications to display web content. This flaw specifically impacts the enforcement of same-origin policies, which are fundamental security constructs designed to isolate documents or scripts loaded from different origins. When an attacker successfully compromises the renderer process through other means, such as exploiting a separate vulnerability in JavaScript execution or DOM manipulation, they can leverage this authorization gap to execute malicious code with elevated privileges that should otherwise be restricted by browser sandboxing rules. The severity is classified as low within Chromium’s internal security framework because it requires prior compromise of the renderer process, indicating that it serves more as an escalation vector rather than a direct entry point for initial exploitation from untrusted remote sources without additional vulnerabilities.
From a technical perspective, this issue stems from improper checks performed when handling navigation or resource loading requests initiated by web content within the WebView context. Normally, the browser engine validates whether the requesting origin has permission to access specific resources or APIs based on strict isolation boundaries. In this instance, these validation steps were either skipped or incorrectly evaluated, allowing a crafted HTML page hosted on an attacker-controlled domain to interact with protected interfaces or data belonging to other origins. This bypass effectively neutralizes one of the primary defenses against cross-site scripting and data theft attacks, enabling potential exfiltration of sensitive user data stored within the application’s local storage or cookies if those resources are accessible via the compromised renderer context.
The operational impact of this vulnerability is significant for users relying on Android applications that embed web views to display dynamic content from untrusted sources. If an attacker can inject malicious HTML into such a view, they may be able to read sensitive information belonging to other tabs or even interact with internal application functions that are not intended to be exposed to the web layer. This could lead to unauthorized access to personal data, session hijacking if authentication tokens are accessible within the compromised scope, or further lateral movement within the device’s security perimeter depending on how deeply the WebView is integrated into the host application’s permissions model. Although the initial entry requires renderer compromise, the ability to bypass origin policies amplifies the risk profile considerably for applications that do not implement additional hardening measures like strict content security policies or sandboxing at the application level.
Mitigation strategies primarily involve updating Google Chrome and all Android devices running affected versions of the WebView component to version 154.0.8037.57 or later, where these authorization checks have been corrected. For developers integrating WebViews into their applications, it is crucial to ensure that the underlying browser engine remains up-to-date through regular system updates and app-specific patching cycles. Additionally implementing robust content security policies within hosted web pages can provide an additional layer of defense by restricting which origins are allowed to execute scripts or access resources. Security teams should also monitor for indicators of compromise related to renderer process anomalies, as this vulnerability highlights the importance of maintaining strict isolation between untrusted web content and privileged application components in mobile environments.
This incident aligns with Common Weakness Enumeration (CWE) category CWE-269, which describes Improper Authorization, where a user is able to access resources or perform actions for which they should not have been granted permission. It also relates to ATT&CK technique T1059, Command and Scripting Interpreter, as the bypass facilitates further script execution within an elevated context. Understanding these mappings helps security professionals categorize similar flaws across different platforms and prioritize remediation efforts based on standardized risk assessments rather than isolated vendor severity ratings alone.