CVE-2026-95358 in Chrome
Summary
by MITRE • 09/29/2026
Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified as an incorrect authorization flaw in Google Chrome for Android, specifically affecting versions prior to 154.0.8037.57, represents a significant breach of the application's internal access control mechanisms. This issue stems from a failure to properly validate permissions when handling requests originating from co-installed applications on the device. In modern mobile operating systems like Android, apps are typically sandboxed to prevent unauthorized interaction with other applications and system resources. However, Chrome’s architecture includes specific entry points that allow for inter-process communication or intent-based interactions between different components of the browser ecosystem and third-party apps installed alongside it. The flaw lies in the insufficient verification of whether these co-installed apps possess the necessary privileges to access certain privileged pages within the Chromium engine. Consequently, an attacker who has managed to install a malicious application with minimal permissions can exploit this gap to escalate their influence beyond what is normally permitted by the operating system's security model.
From a technical perspective, this vulnerability aligns closely with CWE-269, which describes Improper Privilege Management, and more specifically CWE-862, Missing Authorization. The core issue involves the browser failing to enforce strict separation between untrusted local contexts and privileged internal pages such as chrome://settings or other administrative interfaces. When a co-installed app triggers an action that leads Chrome to load these sensitive resources, the application does not adequately check if the calling context is authorized to do so. This allows for a bypass of system access restrictions, effectively granting the malicious app visibility into and potentially control over browser states that should remain isolated from external applications. The severity is classified as Medium within the Chromium security framework because while it requires local installation of an app, the ease with which such apps can be deployed by users or via social engineering makes the attack vector highly viable in real-world scenarios.
The operational impact of this vulnerability extends beyond simple data leakage. An attacker leveraging this flaw could potentially manipulate browser settings, exfiltrate sensitive browsing history, or intercept cookies and session tokens that are stored within privileged contexts. This undermines the integrity of the user's digital identity and privacy expectations on their mobile device. Furthermore, because Chrome serves as a primary gateway to web services for many Android users, compromising its internal authorization logic can serve as a stepping stone for more sophisticated attacks, such as cross-site scripting amplification or phishing facilitation through manipulated browser UI elements. The ability of a local app to interact with privileged pages without proper checks erodes the trust model that mobile operating systems rely upon to maintain system stability and security boundaries between applications.
Mitigation strategies primarily involve updating Google Chrome on Android devices to version 154.0.8037.57 or later, where these authorization checks have been reinforced. Users should ensure automatic updates are enabled for the browser application to receive patches promptly as they become available. From a defensive posture perspective, users must exercise caution when installing applications from unknown sources and review app permissions carefully during installation. Security professionals monitoring Android environments should also look for anomalies in inter-process communication logs that might indicate exploitation attempts of this type. Additionally, adhering to the principle of least privilege by restricting which apps have access to sensitive browser features can further reduce the attack surface. This incident highlights the critical importance of rigorous input validation and authorization checks even within trusted local contexts, as attackers often exploit these internal trust relationships rather than external network vectors.