CVE-2026-79046: Google Chrome Android Race Condition Flaw

CVE-2026-79046 Overview

CVE-2026-79046 is a race condition vulnerability in the Permissions component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker can leverage social engineering to bypass web origin policy through a crafted HTML page. Google classifies the Chromium security severity as Medium.

The vulnerability maps to CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. Attackers exploiting this flaw can circumvent same-origin protections that normally isolate web content from different origins.

Critical Impact
Successful exploitation allows a remote attacker to bypass the web origin policy in Chrome for Android, potentially exposing users to cross-origin data access when they interact with a malicious page.

Affected Products

Google Chrome for Android prior to version 152.0.7977.65
Chromium-based browsers on Android incorporating the vulnerable Permissions code path
Android applications embedding affected Chromium WebView builds

Discovery Timeline

2026-08-25 - CVE-2026-79046 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79046

Vulnerability Analysis

The vulnerability resides in the Permissions component of Chrome on Android. A race condition [CWE-367] exists between the time Chrome checks a permission or origin state and the time it uses that state to enforce the web origin policy. An attacker who wins the race can cause Chrome to apply permission decisions against a different origin than the one originally evaluated.

Exploitation requires user interaction. The attacker must convince the victim to visit or interact with a crafted HTML page, placing this issue in the social engineering category. Because the flaw affects origin isolation, a successful bypass may allow the malicious page to access resources or permissions belonging to another web origin.

Google Chrome addressed the issue in version 152.0.7977.65 on the stable channel. Details are tracked in the Chromium Issue Tracker Entry and the Chrome Stable Update Announcement.

Root Cause

The root cause is a Time-of-check Time-of-use (TOCTOU) condition in permission state handling. Chrome validates the origin or permission state at one point in execution, but the value can change before Chrome enforces the decision. Concurrent operations on the Android platform create the timing window required to trigger the inconsistency.

Attack Vector

The attack vector is a crafted HTML page delivered to a user of Chrome on Android. The attacker relies on social engineering to induce the required interaction, such as clicking a link, granting a permission prompt, or navigating between origins. No verified public exploit or proof-of-concept is currently listed for this CVE.

The vulnerability is described in prose because no verified exploit code has been published. Refer to the Chromium Issue Tracker Entry for further technical detail as Google discloses it.

Detection Methods for CVE-2026-79046

Indicators of Compromise

Chrome for Android instances reporting versions earlier than 152.0.7977.65 in mobile device management (MDM) inventory
Unusual cross-origin resource access recorded in web application logs following user visits to unknown external domains
User-reported permission prompts appearing on unexpected origins during browsing sessions

Detection Strategies

Query MDM and endpoint inventory for Chrome and Chromium WebView build numbers on Android devices, flagging any below 152.0.7977.65
Monitor web proxy and secure web gateway logs for user navigation to newly registered or low-reputation domains hosting HTML content that solicits permission prompts
Correlate authentication and session anomalies on web applications with mobile Chrome user agents on outdated builds

Monitoring Recommendations

Track Chrome for Android release channels and align patch SLAs to the stable update cadence
Alert on Android devices that miss browser update cycles beyond your defined tolerance window
Review permission grant logs from web applications for cross-origin anomalies that could indicate a same-origin policy bypass

How to Mitigate CVE-2026-79046

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
Push a forced browser update policy through enterprise mobility management for managed Android fleets
Educate users to avoid clicking unsolicited links and to reject unexpected permission prompts on unfamiliar sites

Patch Information

Google released the fix in Chrome stable channel version 152.0.7977.65 for Android. Deployment details are available in the Chrome Stable Update Announcement. Enterprises using Android WebView should ensure the Android System WebView package is updated on all managed devices, since the shared Chromium codebase may distribute the same fix.

Workarounds

Restrict browsing on unpatched Android devices to trusted internal sites via secure web gateway policies until the update is applied
Disable or tightly scope sensitive web permissions (camera, microphone, geolocation, notifications) on Chrome for Android through enterprise policy
Deploy DNS filtering to block known malicious and low-reputation domains that could host crafted HTML pages

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName 152.0.7977.65 or later