CVE-2026-79117: Chrome Android Race Condition Vulnerability

CVE-2026-79117 Overview

CVE-2026-79117 is a race condition vulnerability in the WebAppInstalls component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A remote attacker leveraging social engineering can exploit the race condition through a co-installed Android application to bypass the web origin policy. Google's Chromium team rated the security severity as High. The issue is tracked as CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
A successful attack lets a co-installed malicious app bypass the same-origin policy in Chrome for Android, breaking a foundational browser security boundary.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
The WebAppInstalls component in Chromium
Chromium-based mobile browsers sharing the affected install flow

Discovery Timeline

2026-08-25 - CVE-2026-79117 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79117

Vulnerability Analysis

The vulnerability is a race condition in Chrome's WebAppInstalls code path on Android. WebAppInstalls handles the installation and registration of Progressive Web Apps (PWAs) and related web app metadata. When two operations touch shared state without proper synchronization, an attacker can interleave events to reach an inconsistent state. In this case, the inconsistent state allows a co-installed native app to influence how Chrome enforces the web origin policy. The same-origin policy is the core web security boundary that isolates content between different origins. Bypassing it enables cross-origin data theft, session abuse, or hijacking of authenticated user context.

Root Cause

The root cause is improper synchronization on shared resources during web app installation, classified as CWE-362. Concurrent code paths in WebAppInstalls read or update shared state without a lock or atomic guarantee. An attacker who wins the race causes Chrome to associate content with the wrong origin or to trust attacker-controlled metadata.

Attack Vector

Exploitation requires a co-installed Android application and user interaction driven by social engineering. The attacker convinces the user to install a companion app and then trigger a web app install flow in Chrome. The malicious app races Chrome's WebAppInstalls logic to bypass origin enforcement. See the Chromium Issue Tracker #523738212 and the Chrome Releases Update for further detail.

// No verified public proof-of-concept is available.
// Refer to Chromium Issue Tracker #523738212 for technical detail.

Detection Methods for CVE-2026-79117

Indicators of Compromise

Unexpected PWA or web app install prompts appearing shortly after a native Android app installation.
Chrome web app entries whose recorded origin does not match the site the user visited.
Android devices running Chrome versions earlier than 152.0.7977.65 that also host recently sideloaded or newly installed companion apps.

Detection Strategies

Inventory installed Chrome versions on managed Android fleets and flag any build earlier than 152.0.7977.65.
Correlate Android package install events with Chrome web app install events occurring in a narrow time window.
Review mobile device management (MDM) telemetry for apps requesting cross-app interaction with Chrome around web app install activity.

Monitoring Recommendations

Enable enterprise reporting of Chrome version and update state through Chrome Browser Cloud Management or MDM.
Alert on installations of unsigned or unknown-source Android APKs on managed devices.
Monitor authentication logs for anomalous session activity that could indicate origin-policy bypass and cross-origin credential misuse.

How to Mitigate CVE-2026-79117

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
Enforce automatic Chrome updates on managed Android devices via MDM policy.
Restrict installation of applications from unknown sources on corporate Android devices.
Communicate a social-engineering advisory to users, warning against installing unsolicited companion apps that request Chrome interaction.

Patch Information

Google addressed CVE-2026-79117 in Chrome for Android 152.0.7977.65. Details are documented in the Chrome Releases Update and the Chromium Issue Tracker #523738212. Apply the update through the Google Play Store or push it centrally through Android Enterprise.

Workarounds

Disable installation from unknown sources and require Play Protect on managed Android devices until the Chrome update is deployed.
Block or uninstall untrusted companion apps that request tight integration with Chrome.
Advise users to decline unexpected web app install prompts and to install PWAs only from known origins.

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Example expected output after patch
# versionName=152.0.7977.65