CVE-2026-95328 in Chrome
Summary
by MITRE • 09/29/2026
Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as a confused deputy flaw within Google Chrome for Android, specifically in versions prior to 154.0.8037.57, represents a classic authorization failure where an application is tricked into performing actions on behalf of another entity without proper verification of intent. In this context, the vulnerable component acts as the trusted party that possesses elevated privileges or access to sensitive data, while the attacker leverages social engineering techniques to coerce the user into installing a malicious co-installed app. This secondary application then exploits its relationship with Chrome to request resources or execute operations that it should not be permitted to access directly, effectively bypassing standard security boundaries through deception rather than technical exploitation of code logic errors such as buffer overflows or injection flaws.
From a technical perspective, the core issue lies in the insufficient validation of the originator's identity and intent when handling inter-process communication or shared resource requests between applications on the Android operating system. The confused deputy scenario typically arises when an application with higher privileges receives a request from a lower-privileged entity and fails to verify that the user explicitly authorized this specific action for this specific target. In the case of Chrome, this might involve improper checks regarding which app initiated a navigation or data retrieval operation, allowing a maliciously installed companion app to trick the browser into exposing sensitive information such as cookies, session tokens, or browsing history to an unauthorized third party. This type of flaw is fundamentally rooted in weak access control mechanisms that rely on implicit trust relationships rather than explicit user consent and rigorous identity verification for each privileged action.
The operational impact of this vulnerability centers on the potential exfiltration of sensitive personal data by a local attacker who has already gained physical or logical access to the device sufficient to install applications. By leveraging social engineering, the adversary can manipulate users into installing seemingly benign apps that contain malicious payloads designed to interact with Chrome's internal processes. Once installed, these co-installed apps can exploit the confused deputy condition to read data they are not supposed to see, leading to privacy violations and potential compromise of user accounts if session identifiers or authentication tokens are harvested. Although the Chromium security severity is classified as Low due to the requirement for social engineering and local installation, the cumulative risk remains significant because it undermines the confidentiality guarantees expected by users relying on mobile browsers for secure transactions and communications.
This vulnerability aligns with CWE-273, which describes a failure in checking whether an actor has permission to perform an action before performing that action, specifically highlighting the confusion regarding who is requesting the service versus who authorized it. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework for mobile platforms, this behavior corresponds to techniques involving unauthorized access to data through legitimate application interfaces and potentially relates to persistence mechanisms if the co-installed app maintains long-term access. The reliance on social engineering also connects to initial access vectors where human factors are exploited to bypass technical controls, emphasizing that security cannot rely solely on software patches but must include user education regarding app installation practices.
Mitigation strategies for this vulnerability primarily involve updating Google Chrome on Android devices to version 154.0.8037.57 or later, which addresses the underlying authorization checks and ensures that inter-application communications are properly validated against explicit user permissions. Administrators and users should enforce strict app installation policies, avoiding sideloading applications from untrusted sources and regularly auditing installed apps for suspicious behavior. Additionally, enabling Chrome's built-in security features such as Safe Browsing and restricting background data access can reduce the attack surface available to malicious co-installed apps. Future development efforts should focus on implementing stricter sandboxing boundaries between browser processes and third-party applications, ensuring that privileged operations require explicit, verifiable user consent rather than relying on implicit trust relationships that are susceptible to confused deputy attacks.