CVE-2026-79057: Google Chrome Race Condition Vulnerability

CVE-2026-79057 Overview

CVE-2026-79057 is a race condition vulnerability in the Start component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A local attacker who leverages social engineering to convince a user to install a malicious co-installed app can potentially execute arbitrary code outside the Chrome sandbox.

The vulnerability is categorized under CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition. Google classifies the Chromium security severity as Medium, while NVD rates the CVSS impact as High due to sandbox escape potential.

Critical Impact
Successful exploitation permits arbitrary code execution outside the Chrome sandbox on Android, breaking the primary browser isolation boundary that protects user data and system resources.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Google Android (host operating system)
Chromium-based browsers on Android sharing the vulnerable Start code path

Discovery Timeline

2026-08-25 - CVE-2026-79057 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79057

Vulnerability Analysis

The vulnerability resides in the Chrome Start initialization path on Android. During the startup sequence, Chrome performs checks and subsequent actions on shared resources that can be manipulated by another locally installed application. The window between the check and the use allows a co-installed malicious app to substitute or modify the resource before Chrome consumes it.

Because the race occurs during a phase where Chrome establishes sandbox boundaries and process context, winning the race grants the attacker execution privileges that Chrome itself relies on. The result is code execution outside the renderer sandbox rather than inside it.

The attack requires local access through a co-installed app and depends on social engineering to convince the user to install that app. Exploitation is complex and timing-sensitive, but the impact spans confidentiality, integrity, and availability of the Chrome process and adjacent data.

Root Cause

The root cause is a TOCTOU flaw [CWE-367] in the Start component. Chrome validates the state of a resource, then uses it in a later operation without ensuring the state has not changed. On Android, application boundaries and shared inter-process resources make this window observable to other installed apps.

Attack Vector

An attacker distributes a co-installed Android application through sideloading or a compromised store listing. The user installs the app after social engineering. When Chrome is launched, the malicious app races Chrome's startup sequence, manipulating a shared resource between Chrome's check and use. Successful timing results in arbitrary code execution outside the Chrome sandbox. See the Chromium Issue Tracker #505967344 for additional technical context once access is granted.

Detection Methods for CVE-2026-79057

Indicators of Compromise

Chrome for Android versions below 152.0.7977.65 present on managed devices.
Presence of sideloaded or recently installed Android applications with permissions to interact with Chrome's data directory or shared storage.
Unexpected child processes or file writes spawned during Chrome startup on Android endpoints.
Application installation events from unknown sources shortly before Chrome crash or anomaly reports.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag installations below 152.0.7977.65.
Correlate Android package installation telemetry with Chrome launch events to identify race-condition attack patterns.
Alert on Android apps requesting access to Chrome-adjacent resources or content:// providers tied to Chrome.

Monitoring Recommendations

Ingest Mobile Device Management (MDM) telemetry into a centralized log platform and monitor Chrome version drift.
Track application installations from non-Play sources and review permissions granted at install time.
Monitor Google's Chrome Releases blog for further advisories tied to this CVE.

How to Mitigate CVE-2026-79057

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.65 or later on all managed and personal devices.
Audit installed Android applications and remove untrusted or sideloaded packages with no clear business purpose.
Enforce Google Play Protect and disable installation from unknown sources through MDM policy.
Communicate the risk of installing apps from unverified sources to end users and reinforce social-engineering awareness.

Patch Information

Google addressed the race condition in Chrome for Android 152.0.7977.65. Refer to the Google Chrome Stable Update advisory for release details. Chrome typically auto-updates through the Google Play Store; verify update status under Chrome → About Chrome.

Workarounds

Restrict Android app installations to the Google Play Store through MDM configuration until patching is confirmed.
Uninstall recently added apps that request unusual permissions or interact with browser storage.
Advise users to avoid launching Chrome shortly after installing new applications on unpatched devices.

bash

# Example: enforce Play-only installs via Android Enterprise policy (managed configuration)
# applicationPolicy JSON snippet applied by an EMM/MDM
{
  "installType": "BLOCKED",
  "packageName": "*",
  "defaultPermissionPolicy": "DENY",
  "playStoreMode": "WHITELIST"
}

# Verify Chrome version on a connected Android device
adb shell dumpsys package com.android.chrome | grep versionName