CVE-2026-14046: Google Chrome Auth Bypass Vulnerability

CVE-2026-14046 Overview

CVE-2026-14046 is a same-origin policy bypass in the CustomTabs component of Google Chrome on Android. Versions prior to 150.0.7871.47 are affected. A remote attacker can exploit this weakness by luring a user to a crafted HTML page. Successful exploitation allows the attacker to bypass origin isolation guarantees enforced by the browser. The vulnerability is classified under CWE-346: Origin Validation Error. Chromium engineers rated the internal security severity as Low. Exploitation requires user interaction and does not require authentication.

Critical Impact
A crafted web page can subvert the same-origin policy through CustomTabs, exposing limited integrity of data from other origins to attacker-controlled content on Android devices.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Google Android platform hosting affected Chrome builds
Applications embedding Chrome CustomTabs on vulnerable Chrome versions

Discovery Timeline

2026-06-30 - CVE-2026-14046 published to the National Vulnerability Database
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14046

Vulnerability Analysis

The flaw resides in Chrome's CustomTabs implementation on Android. CustomTabs allow Android applications to render web content using the Chrome engine while retaining branding and navigation control. The inappropriate implementation permits a crafted HTML page to circumvent the same-origin policy (SOP). SOP is the foundational browser boundary that isolates documents, scripts, and storage between different origins. Bypassing it enables attacker-controlled content to interact with resources it should not access. The CWE-346 classification indicates that the browser fails to correctly validate the origin of interacting components. Exploitation is bounded by the CVSS integrity impact of low and no direct confidentiality or availability impact.

Root Cause

The root cause is improper origin validation within the CustomTabs code path. When CustomTabs processes navigations or intents originating from a crafted HTML document, it does not enforce the SOP checks required to separate one origin from another. This weakness aligns with CWE-346, where the software does not properly verify the source of data or a communication channel before acting on it.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and induces a victim to open it in Chrome for Android or within an Android application that launches the URL through CustomTabs. Once loaded, the page triggers the flawed logic to influence content across origin boundaries. No privileges are required on the target device.

No public proof-of-concept has been published. Technical details are tracked in the Chromium Issue Tracker #497959724 and the Google Chrome Update Announcement.

Detection Methods for CVE-2026-14046

Indicators of Compromise

Chrome for Android installations reporting a version string earlier than 150.0.7871.47
Android applications launching CustomTabs to unfamiliar external domains shortly after user interaction with untrusted links
Unexpected cross-origin navigation events in browser telemetry originating from CustomTabs sessions

Detection Strategies

Inventory mobile fleet Chrome versions using MDM or UEM tooling and flag hosts below 150.0.7871.47
Correlate web proxy or DNS logs to identify user visits to unknown domains referenced by CustomTabs intents
Review Android application telemetry for anomalous ACTION_VIEW intents that chain into CustomTabs sessions

Monitoring Recommendations

Ingest mobile device inventory into a centralized log platform and alert on outdated Chrome builds
Monitor phishing infrastructure feeds for URLs that specifically target Android CustomTabs users
Track Chrome Stable channel release notes to confirm rapid patch adoption across managed Android devices

How to Mitigate CVE-2026-14046

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Force-push the Chrome update to managed Android devices via MDM if enterprise distribution is used
Audit Android applications that rely on CustomTabs and confirm they depend on the patched Chrome build

Patch Information

Google addressed the issue in the Chrome Stable channel release documented in the Google Chrome Update Announcement. Upgrading Chrome on Android to 150.0.7871.47 or newer removes the vulnerable CustomTabs code path. Enterprises should validate the installed version on all managed handsets after deployment.

Workarounds

Instruct users to avoid opening links from untrusted senders in Chrome or Chrome-backed CustomTabs sessions
Configure enterprise browsers or MDM policies to restrict navigation to allowlisted domains where feasible
Temporarily route sensitive workflows through a non-affected browser engine until the Chrome update is deployed

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output on patched devices:
# versionName=150.0.7871.47 (or later)