CVE-2026-79152 Overview
CVE-2026-79152 is an incorrect authorization vulnerability [CWE-863] in the CustomTabs component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65 and allows a local attacker to bypass the web origin policy through a co-installed application. Chromium classified the security severity as Low, though the National Vulnerability Database (NVD) records a higher CVSS base score reflecting broader impact assumptions.
Critical Impact
A malicious Android application installed alongside Chrome can leverage CustomTabs to bypass same-origin restrictions, exposing users to cross-origin data access and session compromise.
Affected Products
- Google Chrome for Android versions prior to 152.0.7977.65
- Android devices with co-installed applications that invoke Chrome CustomTabs
- Chromium-based mobile browsers sharing the same CustomTabs implementation
Discovery Timeline
- 2026-08-25 - CVE-2026-79152 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79152
Vulnerability Analysis
The vulnerability resides in Chrome's CustomTabs component on Android. CustomTabs allow third-party applications to launch a Chrome-rendered browsing surface within their own user interface. The web origin policy governs which application contexts can read or influence content associated with a given origin.
The defect breaks that boundary. A co-installed application on the same Android device can invoke CustomTabs in a way that Chrome fails to authorize correctly. As a result, actions that should be restricted to a specific web origin become accessible to the calling app.
The consequence is a bypass of the same-origin model on the mobile client. Attackers with a foothold on the device (via a sideloaded or malicious Play Store application) can interact with origins beyond the calling app's legitimate scope.
Root Cause
The root cause is an authorization check failure [CWE-863] inside CustomTabs. Chrome does not sufficiently validate the relationship between the calling Android application and the web origin being accessed. This authorization gap allows the local app to operate against origins it should not control.
Attack Vector
Exploitation requires a co-installed malicious application on the target Android device. The attacker's app invokes CustomTabs and manipulates the interaction to bypass web origin policy enforcement. No remote network exploitation path is documented, and no public proof-of-concept has been released. Technical details are tracked in Chromium Issue Tracker #533083384.
Detection Methods for CVE-2026-79152
Indicators of Compromise
- Android applications requesting CustomTabsService bindings without a legitimate browsing use case
- Unexpected launches of Chrome CustomTabs from recently installed third-party apps
- Anomalous cross-origin navigation events originating from CustomTabs sessions
Detection Strategies
- Inventory installed Android applications on managed devices and flag apps that bind to Chrome CustomTabs but do not require browser integration
- Correlate application install events with subsequent CustomTabs invocations to identify suspicious co-installation patterns
- Monitor Chrome version telemetry from mobile device management (MDM) platforms to identify devices running versions prior to 152.0.7977.65
Monitoring Recommendations
- Enable MDM reporting for Chrome for Android version compliance across the fleet
- Log Android package installation events and review sideloaded APKs
- Alert on applications requesting browser-integration intents outside of approved software categories
How to Mitigate CVE-2026-79152
Immediate Actions Required
- Update Google Chrome for Android to version 152.0.7977.65 or later through Google Play
- Audit managed Android devices for installed applications with browser-integration capabilities
- Restrict sideloading of applications on corporate-owned devices via MDM policy
Patch Information
Google addressed the vulnerability in Chrome 152.0.7977.65 on Android. Details are available in the Google Chrome Stable Update announcement. Deploy the update through Google Play or enterprise mobile management channels.
Workarounds
- Remove unnecessary third-party applications that integrate with Chrome CustomTabs until the patched version is deployed
- Enforce Google Play Protect and block installation from unknown sources on enterprise devices
- Use MDM configuration to require the minimum patched Chrome version before granting access to corporate resources
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
