CVE-2026-79225: Google Chrome Authentication Bypass Flaw

CVE-2026-79225 Overview

CVE-2026-79225 is an incorrect authorization vulnerability in the Browser component of Google Chrome on Android versions prior to 152.0.7977.65. A remote attacker can leverage social engineering and user interface interaction to bypass system access restrictions. Chromium rates the security severity as Low, while NVD assigns a medium rating based on the CVSS v3.1 score. The vulnerability is tracked under CWE-863: Incorrect Authorization. Successful exploitation requires user interaction, meaning victims must be guided through specific UI actions before the access-restriction bypass triggers. No public exploit code or evidence of in-the-wild abuse has been reported.

Critical Impact
Remote attackers can bypass Android system access restrictions in Chrome through crafted UI interactions, potentially exposing limited integrity of browser-mediated resources.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Google Android (host platform for the vulnerable Chrome browser)
Chromium-based mobile browsers sharing the affected Browser component

Discovery Timeline

2026-08-25 - CVE-2026-79225 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79225

Vulnerability Analysis

The flaw resides in the Browser process of Chrome on Android and stems from incorrect authorization logic (CWE-863). The Browser process enforces access restrictions that separate untrusted web content from privileged Android system surfaces. When the affected code path evaluates whether a requested action is permitted, it accepts UI-driven state transitions that should have been rejected. An attacker who convinces the user to perform specific interactions can escape the intended restriction boundary. The impact is limited to integrity (I:L), with no confidentiality or availability effects reported. Because the attack vector is network-based and requires no privileges, any attacker-controlled web page can attempt exploitation once a victim visits it.

Root Cause

The root cause is an authorization check in the Chrome for Android Browser component that does not fully validate the context of a UI-initiated request. Rather than a missing check, the logic accepts an authorization decision path that should not apply during specific UI interaction sequences. Refer to Chromium Issue Tracker #533059149 for the underlying commit and technical discussion.

Attack Vector

Exploitation begins with the victim visiting an attacker-controlled or compromised page on Chrome for Android. The attacker uses social engineering, such as deceptive prompts or overlays, to guide the user through UI actions that trigger the flawed authorization path. Once the user interacts as directed, Chrome allows an action that would normally be blocked by Android system access restrictions. No memory corruption, sandbox escape, or code execution primitive is described. The vulnerability manifests as an authorization bypass at the browser boundary rather than a lower-level exploit primitive.

Detection Methods for CVE-2026-79225

Indicators of Compromise

Chrome for Android instances reporting versions earlier than 152.0.7977.65 in mobile device management inventories.
Web sessions featuring unexpected UI overlays, clickjacking-style prompts, or repeated permission dialogs on Android devices.
Outbound traffic to newly registered or low-reputation domains coinciding with mobile browser activity.

Detection Strategies

Inventory Chrome for Android build strings across managed fleets and flag any version below 152.0.7977.65.
Correlate mobile threat defense telemetry with web proxy logs to identify social engineering lures targeting Android Chrome users.
Monitor for anomalous Android intents or resource accesses launched immediately after browser sessions on unpatched devices.

Monitoring Recommendations

Ingest Chrome version telemetry into the SIEM and alert on installations below the fixed version.
Track user-reported deceptive site incidents and cross-reference against the 152.0.7977.65 patch baseline.
Review Google Safe Browsing and enterprise DNS filtering logs for repeated visits to phishing or social engineering infrastructure.

How to Mitigate CVE-2026-79225

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store or enterprise mobile management.
Enforce automatic Chrome updates on managed Android devices to prevent regression to vulnerable builds.
Reinforce user awareness of social engineering tactics that request unusual in-browser UI interactions.

Patch Information

Google addressed CVE-2026-79225 in the Chrome Stable channel update announced in the Chrome Releases blog. Upgrade Chrome for Android to 152.0.7977.65 or later. Additional technical detail is tracked in Chromium Issue #533059149.

Workarounds

Enable Google Safe Browsing Enhanced Protection to reduce exposure to malicious pages that could deliver the social engineering component.
Restrict browsing on managed Android devices to allow-listed domains until the Chrome update is deployed.
Educate users to close and report unexpected UI prompts rather than interacting with them.

bash

# Configuration example: enforce minimum Chrome for Android version via managed configuration
# Deploy through Android Enterprise (managed configurations for com.android.chrome)
{
  "MinimumChromeVersion": "152.0.7977.65",
  "SafeBrowsingProtectionLevel": 2,
  "ComponentUpdatesEnabled": true
}