CVE-2026-79042: Google Chrome Android Auth Bypass Vulnerability

CVE-2026-79042 Overview

CVE-2026-79042 is a missing authorization vulnerability [CWE-862] in the Payments component of Google Chrome on Android. Versions prior to 152.0.7977.65 are affected. A remote attacker can leverage social engineering with a crafted HTML page to potentially bypass system access restrictions. Chromium rates the security severity as Medium. The flaw requires user interaction, aligning with the social-engineering prerequisite documented in the advisory.

Critical Impact
Attackers who trick users into visiting a crafted page can bypass Payments authorization checks in Chrome for Android, undermining system access restrictions tied to payment flows.

Affected Products

Google Chrome on Android prior to 152.0.7977.65
Chromium-based Android builds sharing the vulnerable Payments component
Downstream Android browsers embedding the affected Chromium version

Discovery Timeline

2026-08-25 - CVE-2026-79042 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79042

Vulnerability Analysis

The vulnerability resides in the Payments subsystem of Chrome for Android. The component fails to enforce a required authorization check before permitting an action that should be gated by system access controls. An attacker delivers a crafted HTML page and uses social engineering to induce the victim to interact with it. The interaction triggers a Payments code path that proceeds without validating the caller's authorization state.

The issue is classified under CWE-862: Missing Authorization. Missing authorization defects allow actors to reach functionality that policy expected to restrict. In this case, the restricted surface is tied to Payments and system access boundaries on Android.

The EPSS probability is 0.317% with a percentile of 23.9 as of 2026-08-27, indicating low near-term exploitation likelihood. No public proof-of-concept or in-the-wild exploitation has been documented in the referenced sources.

Root Cause

The root cause is an absent or incomplete authorization enforcement step inside a Payments code path in Chrome on Android. Details are tracked in Chromium Issue Tracker #513608317. The upstream fix ships in Chrome 152.0.7977.65 as noted in the Google Chrome Stable Update.

Attack Vector

Exploitation requires a remote attacker to host or deliver a crafted HTML page and convince the victim to interact with it on an Android device running a vulnerable Chrome version. Successful exploitation can bypass system access restrictions surfaced through the Payments component. No authentication is required from the attacker, but user interaction is mandatory.

Refer to the vendor advisory for exploitation preconditions. No verified exploit code is available.

Detection Methods for CVE-2026-79042

Indicators of Compromise

Chrome for Android clients reporting versions below 152.0.7977.65 in device telemetry or user-agent logs.
Unexpected navigation events from messaging, ad, or email vectors to unfamiliar HTML pages invoking Payments APIs.
Anomalous Payments-related intents or handlers triggered shortly after a user clicks an untrusted link.

Detection Strategies

Inventory browser versions across managed Android fleets and flag hosts running Chrome earlier than 152.0.7977.65.
Correlate web proxy or DNS logs with newly registered domains delivering pages that invoke PaymentRequest or related Payments flows.
Alert on Android mobile threat defense signals indicating tapjacking, overlay abuse, or coerced user interaction on payment prompts.

Monitoring Recommendations

Track Chrome update compliance through mobile device management (MDM) reporting and enforce minimum version policies.
Monitor user-reported phishing that references payment confirmation or checkout prompts inside the mobile browser.
Review network egress for connections to attacker-controlled infrastructure hosting crafted HTML payment pages.

How to Mitigate CVE-2026-79042

Immediate Actions Required

Update Google Chrome on Android to 152.0.7977.65 or later through the Google Play Store.
Push the update via MDM to enrolled Android devices and confirm rollout coverage.
Communicate phishing awareness guidance covering payment-themed lures and unsolicited HTML pages.

Patch Information

Google addressed the issue in Chrome 152.0.7977.65. Release details are documented in the Google Chrome Stable Update, and technical tracking is available in Chromium Issue Tracker #513608317. Downstream Chromium-based Android browsers should adopt the upstream fix once merged.

Workarounds

Restrict browsing to trusted sites and avoid clicking payment or checkout links from unsolicited messages until patched.
Use enterprise browser policies to block high-risk categories and newly registered domains on managed Android devices.
Consider disabling autofill for payment methods in Chrome until the update is applied fleet-wide.

bash

# Verify Chrome for Android version via adb on a managed device
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should be 152.0.7977.65 or higher