CVE-2026-79273: Chrome Android WebView Auth Bypass Flaw

CVE-2026-79273 Overview

CVE-2026-79273 is an incorrect reference resolution vulnerability in the WebView component of Google Chrome on Android. Versions prior to 152.0.7977.65 are affected. A remote attacker can potentially bypass the web origin policy by serving a crafted HTML page to a vulnerable device. Chromium rates the security severity as Low. The flaw is classified under [CWE-706: Use of Incorrectly-Resolved Name or Reference].

Critical Impact
Successful exploitation allows a remote attacker to bypass the same-origin policy in Chrome for Android WebView, enabling cross-origin data access from an attacker-controlled HTML page.

Affected Products

Google Chrome on Android prior to 152.0.7977.65
Android applications embedding the vulnerable Chrome WebView component
Chromium-based mobile browsers sharing the affected WebView code path

Discovery Timeline

2026-08-25 - CVE-2026-79273 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79273

Vulnerability Analysis

The vulnerability resides in the WebView implementation used by Google Chrome on Android. WebView renders web content inside native Android applications and enforces the web origin policy to isolate documents by origin. Incorrect reference resolution allows a resource or context to be linked to the wrong logical entity during navigation or resource loading. As a result, security boundaries that depend on correct origin association can be evaluated against an unintended target, permitting cross-origin access from a crafted page.

Root Cause

The root cause is improper resolution of a name or reference within the WebView subsystem, categorized as [CWE-706]. When WebView resolves a reference (for example a frame, URL, or object handle) to an underlying security context, the resolution logic returns an incorrect target. Downstream origin checks then operate on stale or mismatched context data, weakening the same-origin guarantee.

Attack Vector

Exploitation requires a victim on an Android device running Chrome prior to 152.0.7977.65 to load attacker-controlled HTML. This can be delivered through phishing, malvertising, a compromised website, or an Android app that renders untrusted content via WebView. No authentication is required, and interaction is limited to visiting the crafted page. No public proof-of-concept or in-the-wild exploitation has been reported. The EPSS probability is 0.202%, indicating low predicted exploitation likelihood.

No verified public exploit code exists for CVE-2026-79273. Refer to the Chromium Issue #517167020 tracker for technical details when access is granted.

Detection Methods for CVE-2026-79273

Indicators of Compromise

Android devices or apps reporting Chrome or WebView versions earlier than 152.0.7977.65.
Outbound requests from mobile browsers to newly registered or low-reputation domains hosting HTML with unusual iframe or navigation constructs.
Unexpected cross-origin fetches or postMessage traffic originating from WebView-hosted content in enterprise mobile applications.

Detection Strategies

Inventory installed Chrome and Android System WebView package versions across managed devices using mobile device management (MDM) telemetry.
Inspect application manifests for embedded WebView usage and correlate with the WebView provider version installed on the device.
Monitor web proxy and DNS logs for mobile user agents matching vulnerable Chrome builds interacting with untrusted domains.

Monitoring Recommendations

Alert when mobile endpoints report Chrome or WebView build strings below 152.0.7977.65.
Track anomalous origin header patterns in mobile web traffic that may indicate origin policy bypass attempts.
Ingest MDM compliance events into the security data lake to correlate outdated browser versions with risky browsing activity.

How to Mitigate CVE-2026-79273

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
Update the Android System WebView package to the current stable release on all managed devices.
Enforce minimum browser and WebView version requirements through MDM compliance policies.

Patch Information

Google addressed CVE-2026-79273 in Chrome 152.0.7977.65 for Android. Details are published in the Google Chrome Stable Update announcement. The corresponding upstream fix is tracked in Chromium Issue #517167020.

Workarounds

Restrict WebView-based applications from loading arbitrary untrusted URLs and enforce allowlists at the application layer.
Block access to untrusted or newly registered domains from mobile devices using DNS filtering or secure web gateway policies.
Disable JavaScript in WebView contexts that do not require it, reducing the surface for crafted HTML exploitation.

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Verify installed Android System WebView version
adb shell dumpsys package com.google.android.webview | grep versionName