CVE-2026-95302 in Chrome
Summary
by MITRE • 09/29/2026
Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an incorrect authorization flaw within WebAPKs in Google Chrome for Android prior to version 154.0.8037.57 represents a significant breach of the browser's isolation model, specifically targeting the boundary between web content and native application contexts. Web Application Installable Prompts (WebAPKs) allow progressive web applications to be installed as standalone apps on Android devices, granting them certain system-level permissions that are typically reserved for native applications while maintaining their underlying web technology foundation. This architectural design inherently increases the attack surface by bridging the gap between sandboxed browser environments and more privileged operating system interfaces. The specific flaw lies in the authorization logic governing how these installed WebAPKs interact with other co-installed applications on the device, failing to strictly enforce origin-based restrictions that are critical for maintaining data confidentiality across different application contexts.
From a technical perspective, this vulnerability stems from an improper access control mechanism where the Chrome browser does not adequately validate whether a local attacker operating through one installed WebAPK is authorized to request or receive sensitive cross-origin data from another co-installed app. In standard web security models, browsers enforce strict same-origin policies to prevent malicious scripts on one origin from accessing resources associated with another. However, when these web applications are packaged as native Android apps via the WebAPK mechanism, they gain elevated privileges that can bypass traditional browser sandboxing if not properly constrained by the operating system's permission model. The flaw allows a local attacker who has control over or influence over one installed application to exploit this misconfiguration to extract data belonging to another application, effectively breaking the isolation boundaries intended to protect user privacy and application integrity.
The operational impact of this vulnerability is substantial for users relying on Chrome as their primary browser on Android devices. An adversary with local access could potentially exfiltrate sensitive information such as authentication tokens, session cookies, personal identifiable information, or proprietary data stored by co-installed applications. This cross-origin data leakage undermines the trust model that web developers and platform providers rely upon to secure user interactions. Furthermore, because the attack vector is localized, it poses a risk in scenarios where multiple malicious or compromised apps are installed on a single device, allowing an attacker to pivot between them using this authorization flaw as a bridge. The severity of this issue is classified as medium by Chromium security standards, reflecting its potential for data compromise without necessarily leading to full system takeover, though the ease of exploitation via co-installed apps makes it particularly dangerous in multi-app environments.
To mitigate this risk, users are strongly advised to update Google Chrome on their Android devices to version 154.0.8037.57 or later immediately upon availability. This patch addresses the underlying authorization logic errors that permitted unauthorized cross-origin data access within the WebAPK framework. In addition to updating the browser, device owners should practice strict app installation hygiene by reviewing permissions granted to installed applications and removing any unnecessary or suspicious apps from their devices. Developers of progressive web applications intended for Android deployment should also ensure they adhere to best practices for secure inter-app communication and avoid relying on implicit trust between co-installed components. Security researchers and penetration testers can map this vulnerability to CWE-269, which covers Improper Privilege Management, as the core issue is a failure in enforcing appropriate access levels. Additionally, it aligns with MITRE ATT&CK techniques related to Local Application Harvesting, specifically those involving credential or data theft through compromised applications on mobile platforms, highlighting the need for robust isolation mechanisms between installed web-based apps and native system resources.