CVE-2026-78936 Overview
CVE-2026-78936 is an observable discrepancy vulnerability in the CustomTabs component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A local attacker with a co-installed application can leverage the discrepancy to obtain cross-origin data from the browser. Google has classified the Chromium security severity as Medium. The weakness is categorized under [CWE-203: Observable Discrepancy], where differences in system behavior expose information to unauthorized actors.
Critical Impact
A malicious co-installed Android application can exploit behavioral differences in Chrome CustomTabs to leak cross-origin data, breaking the same-origin boundary enforced by the browser.
Affected Products
- Google Chrome on Android prior to 152.0.7977.65
- Chromium-based browsers on Android relying on the vulnerable CustomTabs implementation
- Android applications embedding affected Chrome CustomTabs functionality
Discovery Timeline
- 2026-08-25 - CVE-2026-78936 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78936
Vulnerability Analysis
The vulnerability resides in Chrome's CustomTabs feature on Android. CustomTabs allow native Android applications to render web content inside a Chrome-hosted browser surface while retaining a native look and feel. The defect is an observable discrepancy, meaning the browser exposes measurable behavioral differences that reveal information about content from another origin. A locally installed application on the same Android device can observe these differences and infer or extract cross-origin data. Because the attack requires a co-installed app, exploitation is scoped to the local device rather than a remote network attacker. The Environmental Protection Scoring System (EPSS) probability sits at 0.176% with a 7.177 percentile, indicating low current exploitation likelihood.
Root Cause
The root cause is inconsistent handling in CustomTabs that produces observable state or timing differences tied to cross-origin content. Under [CWE-203], such discrepancies allow an unauthorized actor to distinguish states that should be indistinguishable. In this case, the discrepancy leaks information across the same-origin boundary that Chrome normally enforces between web origins loaded in CustomTabs sessions.
Attack Vector
Exploitation requires an attacker-controlled application installed on the same Android device as the vulnerable Chrome build. The malicious app interacts with Chrome CustomTabs, then measures the observable discrepancy to derive information about cross-origin resources. The attack does not require elevated privileges beyond those granted to a standard installed app. See the Chromium Issue #517095594 and the Google Chrome Stable Update advisory for vendor details.
No public proof-of-concept code is available. The vulnerability mechanism is described in prose because no verified exploit sample has been released.
Detection Methods for CVE-2026-78936
Indicators of Compromise
- Presence of Chrome for Android builds with version numbers below 152.0.7977.65 on managed devices
- Newly installed Android applications that repeatedly launch Chrome CustomTabs sessions targeting sensitive third-party origins
- Unusual inter-process communication between untrusted apps and the Chrome package (com.android.chrome)
Detection Strategies
- Inventory installed Chrome versions across the Android mobile fleet using mobile device management (MDM) telemetry and flag versions prior to 152.0.7977.65.
- Review Android application behavior for apps that issue frequent CustomTabs intents combined with side-channel measurement patterns.
- Correlate app install events with subsequent anomalous browser activity to surface potentially malicious co-installed applications.
Monitoring Recommendations
- Enable MDM policies that report Chrome version compliance and alert when devices fall behind the patched baseline.
- Monitor Google Play Protect and enterprise mobile threat defense signals for applications flagged as abusing browser inter-app APIs.
- Track new app installations on corporate-managed Android devices and validate them against an approved application allowlist.
How to Mitigate CVE-2026-78936
Immediate Actions Required
- Update Google Chrome on Android to version 152.0.7977.65 or later on all managed devices.
- Push a mandatory Chrome update through your MDM platform and verify compliance across the fleet.
- Remove unnecessary or untrusted Android applications, particularly those with broad intent-handling capabilities.
Patch Information
Google addressed CVE-2026-78936 in the Chrome Stable channel release documented in the Google Chrome Stable Update. Users and administrators should upgrade to Chrome for Android 152.0.7977.65 or newer. Technical fix details are tracked in Chromium Issue #517095594.
Workarounds
- Restrict installation of non-approved applications on corporate Android devices through MDM policy.
- Advise users to avoid using Chrome CustomTabs for sensitive workflows until patching completes.
- Prefer full Chrome browser sessions over CustomTabs-embedded flows in high-risk applications where feasible.
# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output on patched devices:
# versionName=152.0.7977.65
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
