CVE-2026-79213 Overview
CVE-2026-79213 is an incorrect authorization vulnerability [CWE-863] in the WebAppInstalls component of Google Chrome on Android. Versions of Chrome for Android prior to 152.0.7977.65 fail to properly enforce access restrictions during web application install flows. A remote attacker can bypass system access restrictions by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Medium.
Critical Impact
A remote attacker can bypass system access restrictions on Android by luring a user to a crafted web page, potentially enabling unauthorized web app installation or interaction with protected browser surfaces.
Affected Products
- Google Chrome for Android prior to 152.0.7977.65
- Chromium-based browsers on Android that share the vulnerable WebAppInstalls code path
- Android devices running an unpatched Chrome build
Discovery Timeline
- 2026-08-25 - CVE-2026-79213 published to the National Vulnerability Database
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-79213
Vulnerability Analysis
The flaw resides in the WebAppInstalls subsystem of Chrome on Android, which manages Progressive Web App (PWA) and web app installation prompts. The component performs an authorization check that does not correctly validate the caller's origin or the state under which the install operation is being invoked. Because the check is incomplete, actions that should be gated behind user consent or system-level permission boundaries can be triggered from attacker-controlled content.
The issue is tracked in the Chromium project as issue 513119757 and fixed in the Chrome Stable channel release for Android at build 152.0.7977.65. Exploitation does not require prior authentication and relies on the victim visiting a malicious page in a vulnerable Chrome build.
Root Cause
The root cause is an incorrect authorization pattern mapped to CWE-863. The WebAppInstalls logic evaluates permission or origin state, but the check either accepts an unintended set of callers or fails to enforce the appropriate restriction consistently across the install flow. As a result, a crafted HTML page can reach code paths that should be reserved for privileged or user-approved contexts.
Attack Vector
Exploitation is remote and requires user interaction limited to opening a malicious URL in Chrome for Android. The attacker hosts an HTML page containing markup and script designed to invoke the WebAppInstalls path in a manner that evades the intended access restriction. Delivery vectors include phishing links, malvertising, compromised sites, and iframe embedding on legitimate domains.
No verified proof-of-concept code is publicly available. The Chromium issue tracker entry (513119757) remains restricted at the time of publication, which is standard practice for recently patched Chrome vulnerabilities. See the Chromium Issue Tracker #513119757 for technical details as they become public.
Detection Methods for CVE-2026-79213
Indicators of Compromise
- Unexpected PWA or web app entries appearing on Android home screens or in the Chrome installed apps list
- Chrome on Android reporting a build version lower than 152.0.7977.65 in chrome://version
- Outbound HTTP(S) connections from mobile endpoints to domains hosting manifest.json files followed by install prompts outside normal user workflows
Detection Strategies
- Inventory Chrome for Android versions across managed devices and flag any build below 152.0.7977.65
- Correlate mobile browser telemetry with newly registered or low-reputation domains delivering web app manifests
- Monitor Android package installation events for unexpected TWA (Trusted Web Activity) or PWA entries not initiated by users
Monitoring Recommendations
- Ingest mobile EDR and MDM telemetry into a centralized data lake to track Chrome version drift over time
- Alert on browser navigation events immediately preceding an install prompt from uncommon origins
- Review Android application inventory reports on a recurring cadence for anomalous web app installations
How to Mitigate CVE-2026-79213
Immediate Actions Required
- Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store
- Push the updated Chrome build to managed Android devices via your Mobile Device Management (MDM) or Enterprise Mobility Management (EMM) platform
- Audit installed PWAs and Trusted Web Activities on managed Android endpoints and remove any that were not user-initiated
Patch Information
Google addressed CVE-2026-79213 in the Chrome Stable channel for Android at version 152.0.7977.65. The fix is delivered through the standard Chrome update mechanism on the Google Play Store. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker #513119757 for the authoritative patch reference.
Workarounds
- Restrict Chrome for Android usage on high-risk devices until the update to 152.0.7977.65 is confirmed installed
- Use MDM policy to disable PWA installation on Android where feasible, until patch deployment completes
- Enforce user awareness guidance to avoid clicking untrusted links on mobile devices during the patch rollout window
# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show versionName=152.0.7977.65 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
