CVE-2026-76039: Google Chrome Information Disclosure Flaw

CVE-2026-76039 Overview

CVE-2026-76039 is an incorrect reference resolution vulnerability in the Core component of Google Chrome on Android. Versions prior to 151.0.7922.169 are affected. A remote attacker leveraging social engineering can obtain sensitive information by convincing a user to load a crafted HTML page. The Chromium project classifies the security severity as High, while the NVD assigns a base score of 6.5. The flaw maps to CWE-706: Use of Incorrectly-Resolved Name or Reference. Exploitation requires user interaction, and the impact is limited to confidentiality of data accessible through the affected browser context.

Critical Impact
A crafted HTML page delivered via social engineering can cause Chrome for Android to resolve references incorrectly, exposing sensitive information to a remote attacker.

Affected Products

Google Chrome for Android prior to 151.0.7922.169
Chromium Core component (reference resolution logic)
Downstream Chromium-based Android browsers using the vulnerable Core build

Discovery Timeline

2026-08-18 - CVE-2026-76039 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-76039

Vulnerability Analysis

The vulnerability resides in Chrome's Core component and involves incorrect reference resolution, categorized as [CWE-706]. When Chrome for Android on affected builds parses attacker-controlled HTML, the browser resolves a name or reference to an unintended target. This mismatch enables the attacker to read data that should remain isolated from the malicious origin.

The attack path is network-based and requires user interaction. A victim must navigate to or open a crafted HTML page delivered through phishing, malvertising, or a compromised site. Once loaded, the crafted content triggers the flawed resolution path, and the attacker gains access to sensitive information rendered in or reachable by the browsing context.

The scope remains unchanged and only confidentiality is impacted. Integrity and availability are not affected, which aligns with the information-disclosure nature of the flaw. The EPSS probability at publication is 0.541%.

Root Cause

The root cause is improper handling of references within Chrome's Core code paths. When resolving a name to an object or resource, the browser selects an incorrect target under conditions controllable by attacker-supplied HTML. This allows cross-boundary reads that the browser's security model would otherwise prevent.

Attack Vector

The attack vector is remote and requires a victim to render attacker-controlled HTML in Chrome for Android on a vulnerable build. Social engineering is required to lure the user to the page. No authentication is required, and no privileged access on the device is needed.

No verified public proof-of-concept code is available. Technical specifics reside in the restricted Chromium Issue Tracker Entry and the Chrome Stable Channel Update.

Detection Methods for CVE-2026-76039

Indicators of Compromise

Android endpoints running Chrome versions earlier than 151.0.7922.169
Browser navigation logs showing visits to unfamiliar domains preceded by phishing links or ad redirects
Unexpected outbound requests from Chrome to attacker-controlled hosts following HTML rendering

Detection Strategies

Inventory installed Chrome for Android versions across managed mobile devices and flag any build below 151.0.7922.169
Correlate mobile web proxy or DNS telemetry with known malicious HTML delivery infrastructure and phishing campaigns
Alert on user-reported phishing messages that link to HTML pages targeting Chrome on Android

Monitoring Recommendations

Ingest Chrome update state and version telemetry from MDM into the SIEM for continuous compliance monitoring
Monitor URL categorization feeds for newly registered domains hosting suspicious HTML content targeting mobile users
Track user interaction with links in messaging apps and email clients that redirect to external HTML pages

How to Mitigate CVE-2026-76039

Immediate Actions Required

Update Chrome for Android to version 151.0.7922.169 or later through the Google Play Store
Push the updated Chrome build through mobile device management (MDM) to enforce the patched version across the fleet
Reinforce user awareness against opening unsolicited links, particularly on mobile devices where URL inspection is limited

Patch Information

Google addressed the vulnerability in Chrome Stable channel for Android at version 151.0.7922.169. Refer to the Chrome Stable Channel Update for the official release notes. The underlying fix is tracked in the Chromium Issue Tracker Entry.

Workarounds

Restrict browsing on unpatched Android devices to trusted sites until the update is applied
Deploy mobile web filtering and phishing protection to block delivery of malicious HTML pages
Use a secondary vetted browser on affected devices only if Chrome cannot be updated immediately

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected patched output
# versionName=151.0.7922.169 (or later)