CVE-2026-79044 Overview
CVE-2026-79044 is a missing authorization vulnerability [CWE-862] in the WebAppInstalls component of Google Chrome on Android. Versions prior to 152.0.7977.65 fail to enforce authorization checks when the renderer process interacts with WebAppInstalls functionality. A remote attacker who has already compromised the renderer process can obtain sensitive information by delivering a crafted HTML page to the victim.
Google classifies the Chromium security severity as Medium. The flaw impacts confidentiality but does not affect integrity or availability.
Critical Impact
Attackers with a compromised renderer process can extract sensitive information from Chrome on Android through crafted HTML content targeting WebAppInstalls.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Google Android platforms running affected Chrome builds
- Chromium-based browsers on Android that ship the same WebAppInstalls component
Discovery Timeline
- 2026-08-25 - CVE-2026-79044 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79044
Vulnerability Analysis
The vulnerability resides in Chrome's WebAppInstalls implementation, which handles Progressive Web App (PWA) installation flows on Android. The component fails to verify that the caller has the necessary authorization before returning data. This design gap allows a hostile renderer to reach browser-privileged state that should remain isolated by Chrome's site-per-process sandboxing model.
Exploitation requires a two-stage attack chain. The attacker must first compromise the renderer process, typically through a separate memory corruption or type confusion bug. Once inside the renderer sandbox, the attacker uses a crafted HTML page to invoke WebAppInstalls interfaces and retrieve information that would normally require higher trust.
The scope remains unchanged, meaning the disclosure is bounded to the browser's own security domain. However, the sensitive information exposed can include data useful for further exploitation, such as installed application metadata or session context tied to the browser profile.
Root Cause
The root cause is a missing authorization check [CWE-862] between the renderer process and the browser-side WebAppInstalls handler. The handler trusts incoming Inter-Process Communication (IPC) messages without validating the origin or capability of the caller. This violates Chromium's rule of least privilege at the process boundary.
Attack Vector
The attack vector is network-based with high complexity and requires user interaction. A victim must load attacker-controlled content in Chrome for Android. The attacker must already have code execution inside the renderer, so successful exploitation depends on chaining CVE-2026-79044 with a separate renderer compromise. Refer to the Chromium Issue Tracker #497095313 for the upstream technical discussion.
Detection Methods for CVE-2026-79044
Indicators of Compromise
- Chrome for Android builds reporting a version string below 152.0.7977.65 on managed devices
- Unusual PWA installation prompts or WebAppInstalls activity originating from untrusted domains
- Renderer process crashes or anomalous IPC message patterns preceding data exfiltration
Detection Strategies
- Inventory mobile browser versions across the fleet and flag Android endpoints running Chrome below 152.0.7977.65
- Correlate mobile browser telemetry with outbound traffic to newly observed or low-reputation domains delivering crafted HTML payloads
- Hunt for renderer exploitation precursors, including WebAssembly and JavaScript engine crashes reported through Android crash telemetry
Monitoring Recommendations
- Enforce mobile device management (MDM) policies that report installed browser versions to a central console
- Monitor DNS and TLS Server Name Indication (SNI) logs for repeated visits to domains associated with browser exploit kits
- Track PWA install events on managed Android devices and alert on unexpected installations tied to unmanaged origins
How to Mitigate CVE-2026-79044
Immediate Actions Required
- Update Google Chrome for Android to version 152.0.7977.65 or later through the Google Play Store
- Push the update to all managed Android devices using MDM or enterprise mobility management (EMM) policies
- Audit Chromium-based Android browsers in the environment and confirm they have incorporated the upstream fix
Patch Information
Google released the fix in the Chrome Stable Channel update covering version 152.0.7977.65. Details are available in the Chrome Stable Channel Update release notes and the Chromium Issue Tracker #497095313. Apply the update through Google Play or vendor-managed update channels.
Workarounds
- Restrict browsing to trusted domains through mobile web filtering until the patch is deployed
- Disable or restrict PWA installation on managed devices via Chrome Enterprise policies where feasible
- Require the latest Chrome version as a conditional access requirement for corporate resources
# Verify Chrome for Android version on a managed device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output for patched devices:
# versionName=152.0.7977.65
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
