CVE-2026-79124: Google Chrome Information Disclosure Flaw

CVE-2026-79124 Overview

CVE-2026-79124 is an information disclosure vulnerability in the Intents component of Google Chrome on Android. Versions prior to 152.0.7977.65 allow a remote attacker to leak sensitive information through a crafted HTML page. The flaw is categorized under [CWE-200] (Exposure of Sensitive Information to an Unauthorized Actor). Chromium developers assigned the internal severity rating of Low, while the NVD published a higher CVSS base score reflecting network reach and confidentiality impact. Exploitation requires user interaction, such as visiting an attacker-controlled page.

Critical Impact
A remote attacker can exfiltrate sensitive information from Chrome on Android by luring a user to a malicious HTML page that abuses Android Intents handling.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Google Android (as the host platform for the affected Chrome browser)
Chromium-based mobile browsers sharing the vulnerable Intents implementation

Discovery Timeline

2026-08-25 - CVE-2026-79124 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79124

Vulnerability Analysis

The vulnerability resides in how Chrome for Android processes Android Intents originating from web content. Android Intents are messaging objects used to request an action from another application component. When Chrome parses an Intent triggered by a crafted HTML page, the browser exposes data that should remain isolated from web origins. An attacker hosts a malicious page and induces the victim to load it in Chrome for Android. The crafted page uses Intent URIs or related mechanisms to solicit information the renderer or browser process should not reveal to untrusted origins. The disclosed data can support follow-on attacks, including account takeover and further browser-based exploitation.

Root Cause

The root cause is improper handling of Intent-related data flows between web content and the Android platform layer in Chrome. Insufficient origin isolation or output filtering during Intent processing allows a remote origin to observe values that should remain confidential. Google Chrome versions before 152.0.7977.65 contain this defective handling in the Intents component.

Attack Vector

Exploitation occurs over the network and requires user interaction. The victim must open a crafted HTML page in a vulnerable Chrome for Android build. No authentication or elevated privileges are required. Successful exploitation returns sensitive information to the attacker without altering integrity or availability of the target device.

No public proof-of-concept or exploit code is available for CVE-2026-79124. See the Chromium Issue Tracker Entry for technical detail once public access is granted.

Detection Methods for CVE-2026-79124

Indicators of Compromise

Outbound HTTP or HTTPS requests from mobile clients running Chrome for Android versions earlier than 152.0.7977.65 to newly registered or low-reputation domains hosting HTML with intent:// URIs.
Unusual mobile browser telemetry showing repeated navigation to pages that trigger Intent handler prompts followed by outbound beaconing to attacker infrastructure.
User reports of unexpected app-choice prompts or redirects after opening links delivered via SMS, email, or messaging apps.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets using mobile device management (MDM) reports and flag any client below 152.0.7977.65.
Inspect web proxy and secure web gateway logs for HTML responses containing intent:// schemes served to mobile user agents.
Correlate mobile browser navigation events with subsequent authentication anomalies or session token misuse that could indicate leaked data reuse.

Monitoring Recommendations

Enable continuous browser version telemetry from MDM and enterprise mobility platforms.
Forward mobile web traffic and DNS logs into a centralized analytics platform for retroactive hunting once indicators become available.
Subscribe to the Chrome Releases blog and Chromium issue tracker for updates related to CVE-2026-79124.

How to Mitigate CVE-2026-79124

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.65 or later on all managed devices.
Push the update through Google Play managed configurations or MDM enforcement policies to eliminate lag from user-initiated updates.
Communicate the risk to end users and instruct them to avoid opening untrusted links on mobile devices until the update is confirmed installed.

Patch Information

Google addressed CVE-2026-79124 in Chrome 152.0.7977.65 for Android. Refer to the Chrome Desktop Update announcement and the Chromium Issue Tracker Entry for the authoritative fix reference. No alternative vendor patch is available.

Workarounds

Restrict mobile browsing to trusted domains through enterprise DNS filtering or secure web gateway policies until patching completes.
Use MDM controls to require automatic updates for Chrome and to block installation of outdated versions.
Instruct users to open unknown links in a sandboxed browser profile or on a patched device until the fleet is fully updated.

bash

# Verify Chrome for Android version via ADB against the fixed build
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be 152.0.7977.65 or higher