CVE-2026-79055 Overview
CVE-2026-79055 is an information disclosure vulnerability in the Sharing component of Google Chrome on Android. Versions prior to 152.0.7977.65 are affected. A local attacker who leverages social engineering can obtain sensitive information through a co-installed application on the same device. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google classifies the Chromium security severity as Low, while the NVD assigns a medium rating based on the confidentiality impact.
Critical Impact
A malicious co-installed Android application can exfiltrate sensitive data shared through Chrome's sharing subsystem when the user is manipulated into initiating a share action.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Google Android platform (host operating system)
- Chromium-based sharing subsystem on Android
Discovery Timeline
- 2026-08-25 - CVE-2026-79055 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-79055
Vulnerability Analysis
The vulnerability resides in the Sharing feature of Google Chrome on Android. Chrome exposes share intents so users can send links, text, and other content to other applications installed on the device. The affected implementation permits a co-installed application to observe or receive sensitive information that should remain scoped to the browser or the intended recipient. Exploitation requires local access, high attack complexity, and no privileges, but does not require user interaction at the Chromium boundary. Successful exploitation results in disclosure of confidential data without impacting integrity or availability. The issue is tracked internally as Chromium Issue #497232609.
Root Cause
The root cause is improper isolation of sensitive data handled by the Sharing component when interacting with other Android applications. Chrome's Android sharing path either exposes fields intended to be private or fails to constrain which co-installed apps may consume shared payloads. This aligns with CWE-200, where an application unintentionally makes information available to actors outside its trust boundary.
Attack Vector
An attacker must first convince the victim to install a malicious application on the same Android device. The attacker then relies on social engineering to prompt the victim to initiate a share operation from Chrome. Once the user triggers the share flow, the co-installed application receives or observes sensitive information exposed by the vulnerable Sharing component. The attack does not traverse the network and does not require elevated Android permissions.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-79055
Indicators of Compromise
- Presence of untrusted Android applications that register broad ACTION_SEND or ACTION_SEND_MULTIPLE intent filters targeting content types Chrome shares.
- Unusual user reports of applications appearing as unexpected share targets alongside Chrome.
- Chrome for Android versions earlier than 152.0.7977.65 on managed mobile fleets.
Detection Strategies
- Inventory Android endpoints and identify devices running Chrome builds below 152.0.7977.65 using mobile device management (MDM) telemetry.
- Correlate application installation events with subsequent Chrome share activity in mobile threat defense logs.
- Review sideloaded application manifests for intent filters that could intercept sensitive share payloads.
Monitoring Recommendations
- Enable continuous version compliance monitoring for Chrome on Android through enterprise mobility platforms.
- Track application install sources and flag installations from outside Google Play or approved enterprise stores.
- Log user reports of anomalous share dialog behavior and correlate against known-bad application hashes.
How to Mitigate CVE-2026-79055
Immediate Actions Required
- Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
- Audit managed Android devices and enforce the patched Chrome version through MDM policy.
- Remove sideloaded or unverified Android applications from corporate devices.
- Educate users to avoid initiating share operations when prompted by unfamiliar applications.
Patch Information
Google released the fix in the Chrome Stable channel. Refer to the Google Chrome Stable Update advisory for release details. Technical tracking is available in Chromium Issue #497232609. Upgrading to Chrome 152.0.7977.65 or later remediates the vulnerability.
Workarounds
- Restrict installation of applications to vetted enterprise stores until the patch is deployed.
- Configure Android work profiles to isolate Chrome from personal applications that could act as share targets.
- Disable or discourage use of Chrome's share sheet on high-sensitivity managed devices until updated.
# Verify Chrome for Android version via adb on a managed device
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 152.0.7977.65 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
