CVE-2026-79086: Chrome Android Information Disclosure Flaw

CVE-2026-79086 Overview

CVE-2026-79086 is a missing authorization vulnerability [CWE-862] in the CustomTabs component of Google Chrome on Android. Versions prior to 152.0.7977.65 fail to enforce proper authorization checks, allowing a co-installed malicious application on the same Android device to obtain sensitive information from Chrome. Google classifies the Chromium security severity as Medium. The flaw requires local access through another installed app rather than remote network exploitation. No public proof-of-concept or in-the-wild exploitation has been reported.

Critical Impact
A co-installed Android application can abuse Chrome CustomTabs to read sensitive browser information without user consent, undermining app-to-app isolation on the device.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Android applications embedding Chrome CustomTabs from vulnerable Chrome versions
Chromium-based mobile browsers sharing the affected CustomTabs implementation

Discovery Timeline

2026-08-25 - CVE-2026-79086 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79086

Vulnerability Analysis

CustomTabs is an Android feature that lets third-party apps embed a Chrome-powered browsing surface while retaining some interaction with the host app. The affected implementation omits an authorization check that should restrict which caller can invoke specific CustomTabs functionality or read associated data. A locally installed app on the same device can invoke the exposed interface and receive information intended for privileged callers. The attack requires no user interaction and no elevated privileges on the calling app side, though exploitation complexity is elevated because the attacker must already have an app installed on the target device. The impact is confined to confidentiality; integrity and availability are not affected.

Root Cause

The root cause is a missing authorization control [CWE-862] in the CustomTabs code path. The component exposes an interface to other Android apps but does not validate whether the calling package or Android identity is entitled to the requested data or action. Because Android's inter-process communication (IPC) surface treats CustomTabs as an app-facing entry point, any co-installed app can reach it.

Attack Vector

Exploitation is local. An attacker distributes a malicious or repackaged Android application through sideloading or an app store. Once installed alongside a vulnerable Chrome build, the attacker's app issues CustomTabs requests or binds to the exposed component to extract sensitive browser data. No network access to Chrome is required, and the victim need not open the malicious app in the foreground for certain interactions.

See the Chromium Issue Tracker entry #511804361 and the Google Chrome Stable Channel Update for vendor-supplied technical detail.

Detection Methods for CVE-2026-79086

Indicators of Compromise

Android applications with no legitimate need to launch CustomTabs invoking androidx.browser.customtabs intents or binding to Chrome service components.
Chrome for Android versions earlier than 152.0.7977.65 present on managed devices.
Unexpected CustomTabsService bind events originating from recently installed or low-reputation packages.

Detection Strategies

Inventory Chrome versions across the managed Android fleet using MDM or UEM telemetry and flag any build below 152.0.7977.65.
Review installed application lists for untrusted packages that declare interactions with com.android.chrome or CustomTabs intents.
Correlate mobile threat defense telemetry for suspicious IPC or intent patterns against Chrome from non-browser apps.

Monitoring Recommendations

Enable mobile endpoint telemetry that records intent traffic and service bindings between third-party apps and browsers.
Alert on installation of unknown or sideloaded APKs on devices that also run outdated Chrome builds.
Track Chrome auto-update health on Android to identify devices that remain on vulnerable versions.

How to Mitigate CVE-2026-79086

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
Enforce a minimum Chrome version policy through MDM or UEM and block devices that fail to comply.
Audit installed applications on managed Android devices and remove sideloaded or untrusted packages.

Patch Information

Google addressed CVE-2026-79086 in Chrome for Android 152.0.7977.65. Details are published in the Google Chrome Stable Channel Update. The underlying fix is tracked in the Chromium Issue Tracker #511804361. Confirm the update has been applied by checking chrome://version on the device or through fleet management telemetry.

Workarounds

Restrict app installation to Google Play and disable installation from unknown sources on managed devices.
Use Android work profiles to isolate Chrome and enterprise data from personal or untrusted apps.
Where feasible, direct users to an alternative up-to-date browser on devices that cannot receive the Chrome update.

bash

# Verify Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Enforce Play Store managed configuration to require minimum Chrome version
# (applied through your MDM/UEM console targeting com.android.chrome)
# minimumVersionCode: 152.0.7977.65