CVE-2026-79233: Google Chrome CustomTabs XSS Vulnerability

CVE-2026-79233 Overview

CVE-2026-79233 is a user interface (UI) misrepresentation vulnerability in the CustomTabs component of Google Chrome on Android. Versions prior to 152.0.7977.65 allow a remote attacker to spoof the address bar through a crafted HTML page. The flaw is categorized under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Chromium's internal security team rated the issue as Low severity, while the National Vulnerability Database assigned a Medium rating. Successful exploitation requires user interaction and enables phishing or social engineering scenarios by hiding the true origin of the page displayed inside a Custom Tab.

Critical Impact
An attacker who convinces a user to visit a crafted page can spoof the Chrome for Android address bar, undermining trust indicators and enabling credential phishing.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Applications on Android embedding Chrome CustomTabs functionality from vulnerable Chrome builds
Chromium-based mobile browsers on Android that inherit the vulnerable CustomTabs implementation

Discovery Timeline

2026-08-25 - CVE-2026-79233 published to the National Vulnerability Database
2026-08-27 - Last updated in the NVD database
Stable channel fix - Addressed in Chrome 152.0.7977.65 per the Google Chrome Stable Update
Tracking - Details recorded in Chromium Issue Tracker #514061923

Technical Details for CVE-2026-79233

Vulnerability Analysis

CustomTabs is an Android feature that lets external applications launch a Chrome-rendered browsing surface while retaining app branding elements. The component still displays the origin of the loaded page in a trimmed URL bar. This vulnerability allows a crafted HTML page to manipulate what the CustomTabs URL bar renders, so users cannot rely on the displayed origin as an authenticity signal. The classification under [CWE-451] confirms the flaw is a misrepresentation of security-critical UI, not a memory safety issue. Exploitation requires the target to open an attacker-supplied link, then interact with the page inside a Custom Tab. Because CustomTabs is commonly used by messaging, social, and mail apps, a single tap on a link can bring the user directly into a spoofed context.

Root Cause

The root cause resides in how CustomTabs updates and displays origin information after certain navigations or DOM state changes triggered by the loaded page. A malicious page can drive the browser into a state where the visible address bar no longer reflects the actual document origin. This weakens the browser's origin indicator, which is a primary trust signal on mobile where full URLs are truncated.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a crafted HTML page and delivers the link through email, chat, social media, or a compromised website. When a victim opens the link inside an app that uses CustomTabs, the page executes logic that causes the address bar to show an attacker-chosen origin. The victim then submits credentials or sensitive input believing they are on a trusted site. No privileges, authentication, or additional exploit chaining are required; confidentiality is not directly impacted, but integrity of the browsing context is compromised.

No verified public proof-of-concept code is available for CVE-2026-79233. Refer to the Chromium Issue Tracker #514061923 once access restrictions are lifted for technical specifics.

Detection Methods for CVE-2026-79233

Indicators of Compromise

Outbound requests from Android devices to newly registered domains that mimic legitimate brands and are delivered via app-launched CustomTabs sessions.
Chrome for Android versions below 152.0.7977.65 reported by mobile device management (MDM) or endpoint inventory.
User reports of Chrome CustomTabs sessions where the displayed address bar does not match the destination site behavior.

Detection Strategies

Inventory Android endpoints for Chrome build versions and flag any device running a version earlier than 152.0.7977.65.
Correlate phishing telemetry (submitted credentials, brand impersonation domains) with mobile browser user-agent strings referencing outdated Chrome builds.
Hunt in proxy and DNS logs for high-entropy or lookalike domains referenced by shortened links sent through corporate messaging platforms.

Monitoring Recommendations

Monitor mobile threat defense and MDM feeds for outdated Chrome versions and enforce update compliance policies.
Track click-through telemetry from secure email and messaging gateways to identify users who launched suspicious links on Android.
Alert on repeated visits from managed Android devices to domains matching known phishing kit fingerprints.

How to Mitigate CVE-2026-79233

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
Push a forced update through MDM or enterprise mobility management for managed Android fleets.
Communicate to users that address bar spoofing is possible on outdated Chrome for Android and instruct them to verify sites via bookmarks or typed URLs when handling credentials.

Patch Information

Google addressed CVE-2026-79233 in the Chrome stable channel release documented in the Google Chrome Stable Update. Users should install Chrome 152.0.7977.65 or later on Android. Chromium-based mobile browsers that reuse the CustomTabs implementation must pick up the corresponding upstream fix. Track remediation progress against the record in the Chromium Issue Tracker #514061923.

Workarounds

Configure enterprise browsers or MDM policies to prefer a full browser session over CustomTabs for sensitive workflows until all devices are patched.
Train users to long-press or expand truncated URL bars to inspect the full origin before entering credentials on Android.
Deploy anti-phishing controls at the network and email layer to reduce exposure to crafted links that leverage CustomTabs.

bash

# Example: query Android endpoints for Chrome version via ADB in a lab or managed environment
adb shell dumpsys package com.android.chrome | grep versionName
# Expected remediated output: versionName=152.0.7977.65 (or later)