CVE-2026-79146 Overview
CVE-2026-79146 is an information disclosure vulnerability in the CustomTabs component of Google Chrome on Android. Versions of Chrome earlier than 152.0.7977.65 allow a co-installed malicious application on the same Android device to obtain cross-origin data from the browser. Google's Chromium project rates the security severity as Medium and categorizes the flaw under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. The attack requires local access through another installed app rather than remote network exploitation.
Critical Impact
A locally installed Android application can read cross-origin data rendered inside Chrome CustomTabs, breaking the same-origin boundary that isolates web content across sites.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Android applications embedding Chrome CustomTabs via the AndroidX Browser library
- Downstream Chromium-based Android browsers that inherit the CustomTabs implementation
Discovery Timeline
- 2026-08-25 - CVE-2026-79146 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-79146
Vulnerability Analysis
The flaw resides in Chrome's CustomTabs implementation on Android. CustomTabs let a native app open web content inside a Chrome-hosted tab while keeping the calling app's branding and session. This surface bridges native inter-process communication and web origins, which makes cross-origin isolation harder to enforce. In vulnerable builds, a co-installed app can query or observe data associated with a different web origin loaded through CustomTabs. The exposure falls under [CWE-200] and enables a confidentiality breach without requiring privilege escalation or user credential theft.
Root Cause
The root cause is an information-leak defect in how CustomTabs mediates data between the hosting Android app and the web content it renders. Fields, identifiers, or callback data that should remain scoped to their originating web origin become reachable to a second local application. Full technical details are tracked in Chromium Issue #517772510.
Attack Vector
Exploitation requires an attacker-controlled application to be installed on the same Android device as a vulnerable Chrome build. The malicious app interacts with Chrome through CustomTabs intents or related IPC surfaces. It then observes cross-origin data leaked by the CustomTabs session. No remote network access is required, and no user interaction with a phishing page is needed once the malicious co-installed app is running. No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified proof-of-concept code is available.
See Chromium Issue #517772510 for technical specifics once access is granted.
Detection Methods for CVE-2026-79146
Indicators of Compromise
- Android applications that repeatedly launch Chrome CustomTabs sessions with unusual Intent extras or callback registrations.
- Chrome for Android versions reported by managed devices below 152.0.7977.65.
- Unexpected outbound network activity from a third-party app immediately after a CustomTabs session closes, suggesting exfiltration of leaked data.
Detection Strategies
- Inventory the installed Chrome version across managed Android endpoints and flag any build older than 152.0.7977.65.
- Review recently installed applications on corporate Android devices for apps that request android.support.customtabs bindings without a clear business purpose.
- Correlate mobile threat defense telemetry for co-installed apps that interact with Chrome IPC surfaces around the time sensitive web sessions occur.
Monitoring Recommendations
- Enforce mobile device management policies that require Chrome updates within a defined SLA after each stable channel release.
- Monitor Google Play Protect and enterprise mobile threat defense alerts for apps abusing browser integration APIs.
- Track the Google Chrome Releases blog for follow-up advisories referencing CustomTabs regressions.
How to Mitigate CVE-2026-79146
Immediate Actions Required
- Update Google Chrome for Android to version 152.0.7977.65 or later through the Google Play Store on every managed device.
- Audit installed Android applications and remove any untrusted or unnecessary apps that could act as the local co-installed attacker.
- Restrict sideloading and enforce Google Play Protect on enterprise-managed Android fleets.
Patch Information
Google addressed CVE-2026-79146 in Chrome for Android 152.0.7977.65. Details of the update are published in the Chrome Stable Channel Update and the corresponding Chromium Issue #517772510. Chromium-based downstream Android browsers should pull the fix once they rebase on the patched Chromium version.
Workarounds
- Where immediate patching is not possible, restrict use of Chrome CustomTabs by directing users to open sensitive web sessions in a full Chrome browser window instead of embedded CustomTabs.
- Apply mobile device management policies that block installation of non-approved applications, reducing the availability of a co-installed attacker app.
- Use per-app VPN or work profile isolation to keep sensitive web sessions separate from personal or untrusted Android applications.
# Verify the installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output on a patched device:
# versionName=152.0.7977.65
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
