CVE-2026-79180 Overview
CVE-2026-79180 is a user interface misrepresentation vulnerability in the CustomTabs component of Google Chrome on Android. Versions prior to 152.0.7977.65 allow a remote attacker to spoof UI elements through a crafted HTML page. The flaw is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information and requires social engineering to exploit. Chromium rates the security severity as Medium.
Attackers can abuse the flaw to disguise trusted browser chrome, potentially tricking users into disclosing credentials or trusting malicious content served through a Chrome CustomTab.
Critical Impact
A remote attacker can spoof address bar or security indicators inside CustomTabs, undermining the visual trust cues that users rely on to distinguish legitimate sites from phishing pages.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Android applications embedding Chrome CustomTabs from vulnerable Chrome builds
- Chromium-based Android browsers sharing the affected CustomTabs implementation
Discovery Timeline
- 2026-08-25 - CVE-2026-79180 published to the National Vulnerability Database
- 2026-08-26 - Last updated in the NVD database
Technical Details for CVE-2026-79180
Vulnerability Analysis
The vulnerability resides in Chrome's CustomTabs implementation on Android. CustomTabs allow Android applications to launch a customized Chrome browser view while retaining a portion of the host application's UI. This shared UI surface creates opportunities for visual ambiguity between application content and browser-rendered content.
A crafted HTML page loaded inside a CustomTab can render elements that visually overlap or mimic native browser indicators. Users cannot reliably distinguish spoofed elements from authentic browser chrome. The condition is tracked as [CWE-451] and requires user interaction, which the attacker obtains through social engineering.
The EPSS probability is 0.224% with a percentile of 12.799, reflecting low observed exploitation activity at publication.
Root Cause
The root cause is inadequate isolation between attacker-controlled HTML content and trusted UI surfaces rendered by CustomTabs. Chrome does not sufficiently constrain how page content can visually approximate security indicators such as the URL bar, lock icon, or origin display. See the Chromium Issue Tracker #517719358 for technical details.
Attack Vector
An attacker hosts a crafted HTML page and directs a victim to open it through a link that triggers a CustomTab. The page renders spoofed UI elements that mimic browser security indicators. The victim then trusts the displayed origin or security state and performs sensitive actions, such as entering credentials or approving a transaction.
No verified public exploit code is available. Refer to the Google Chrome Stable Release Update for vendor-provided detail on the fix.
Detection Methods for CVE-2026-79180
Indicators of Compromise
- Android devices running Chrome versions earlier than 152.0.7977.65
- Unexpected CustomTab launches from unfamiliar applications or deep links
- User reports of mismatched URLs, lock icons, or origin text within embedded browser views
- Credential submissions from mobile devices to domains not matching displayed origins
Detection Strategies
- Inventory Chrome for Android build numbers across managed mobile fleets and flag hosts below 152.0.7977.65
- Correlate mobile web traffic against known phishing infrastructure and newly registered domains delivered through app-launched CustomTabs
- Alert on outbound authentication flows from mobile devices where the referring app context differs from the target service's expected origin
Monitoring Recommendations
- Ingest Mobile Device Management (MDM) inventory data into the security data lake to track Chrome versions continuously
- Monitor web proxy and DNS telemetry from mobile endpoints for domains associated with credential harvesting
- Review Android application logs for unusual CustomTabs intent activity originating from sideloaded or low-reputation applications
How to Mitigate CVE-2026-79180
Immediate Actions Required
- Update Google Chrome on Android to version 152.0.7977.65 or later via Google Play
- Push a mandatory Chrome update policy through MDM to enforce the patched version on managed devices
- Communicate phishing awareness guidance highlighting mobile UI spoofing risks in embedded browser views
Patch Information
Google addressed the vulnerability in Chrome Stable channel release 152.0.7977.65 for Android. Details are documented in the Google Chrome Stable Release Update and the Chromium Issue Tracker #517719358. Applications that bundle or depend on Chromium components should incorporate the upstream fix.
Workarounds
- Restrict installation of untrusted Android applications that can invoke CustomTabs through mobile application management policies
- Configure conditional access to require phishing-resistant authentication for sensitive services accessed from mobile devices
- Advise users to open sensitive links in a full Chrome browser session rather than through in-app CustomTabs
# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output for a patched device:
# versionName=152.0.7977.65
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
