CVE-2026-79089: Chrome Android Race Condition Vulnerability

CVE-2026-79089 Overview

CVE-2026-79089 is a race condition vulnerability in the Transactions Platform component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker who leverages social engineering can bypass system access restrictions by serving a crafted HTML page to a targeted user.

The issue is categorized under CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. Chromium classifies the security severity as Low. Exploitation requires user interaction, and the Exploit Prediction Scoring System (EPSS) reflects a low probability of near-term exploitation.

Critical Impact
A crafted HTML page can exploit a timing window in Chrome's Transactions Platform on Android to bypass system access restrictions, subject to user interaction driven by social engineering.

Affected Products

Google Chrome for Android versions prior to 152.0.7977.65
Transactions Platform component within Chromium on Android
Downstream Chromium-based Android browsers that share the vulnerable Transactions Platform code path

Discovery Timeline

2026-08-25 - CVE-2026-79089 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in the NVD database

Technical Details for CVE-2026-79089

Vulnerability Analysis

The vulnerability resides in Chrome's Transactions Platform on Android. It stems from a race condition [CWE-367] between the moment a security-relevant state is checked and the moment that state is used. During this narrow window, an attacker-controlled page can alter conditions so that a subsequent operation proceeds under stale assumptions.

The outcome is a bypass of system access restrictions. The attack does not grant arbitrary code execution on its own. Instead, it undermines a boundary that Chrome relies on to gate access to protected resources, according to the Chromium issue tracker.

Exploitation is remote but requires the user to visit or interact with attacker-controlled content. This positions the flaw as a supporting primitive within a broader social engineering chain rather than a standalone exploit.

Root Cause

The root cause is a Time-of-check Time-of-use (TOCTOU) condition within the Transactions Platform. Two concurrent operations access shared state without adequate synchronization. An attacker who wins the race can cause the security check and the privileged action to observe different values.

Attack Vector

The attack vector is a crafted HTML page delivered to a Chrome for Android user through phishing, malvertising, or a compromised site. The attacker times DOM, worker, or transaction operations to trigger the race. Successful exploitation lets the page perform actions that Chrome's access restrictions should have blocked.

No verified proof-of-concept exploit code is available. Technical specifics are tracked in the Chromium Issue Tracker Entry and the Chrome Desktop Update Announcement.

Detection Methods for CVE-2026-79089

Indicators of Compromise

Chrome for Android clients running versions earlier than 152.0.7977.65 connecting to unfamiliar or newly registered domains hosting HTML with heavy concurrent worker or transaction activity.
Unexpected access to protected Chrome-managed resources following a browsing session initiated from a phishing message or ad redirect.
Repeated navigations to a single attacker-controlled page correlated with anomalous mobile process behavior.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag any device below 152.0.7977.65.
Correlate mobile web proxy or DNS logs with threat intelligence for pages abusing race-condition primitives in Chromium.
Alert on user reports of unexpected permission prompts or resource access originating from Chrome on Android.

Monitoring Recommendations

Ingest mobile browser telemetry and Mobile Device Management (MDM) posture data into a centralized analytics platform to identify unpatched Chrome versions.
Monitor URL categorization services for domains flagged as hosting Chromium exploitation content.
Track social engineering campaigns targeting mobile users, including SMS phishing links that funnel victims to crafted HTML pages.

How to Mitigate CVE-2026-79089

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.65 or later through the Google Play Store.
Enforce automatic updates for Chrome in MDM policies to reduce exposure windows.
Communicate phishing awareness guidance to mobile users, emphasizing suspicious links delivered by SMS, chat, and email.

Patch Information

Google addressed CVE-2026-79089 in Chrome 152.0.7977.65 for Android. Refer to the Chrome Desktop Update Announcement and the Chromium Issue Tracker Entry for release details. No vendor-issued workaround replaces the patch.

Workarounds

Restrict browsing to trusted sites via mobile web filtering while the update is deployed.
Disable Chrome's Transactions Platform-dependent features through enterprise policy where feasible until the fix is applied.
Route mobile traffic through an inspecting proxy that blocks known malicious HTML payloads.

bash

# Verify Chrome for Android version on a managed device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 152.0.7977.65 or later