CVE-2026-79286: Google Chrome RCE Vulnerability

CVE-2026-79286 Overview

CVE-2026-79286 is a missing authorization vulnerability in the CustomTabs component of Google Chrome on Android. The flaw affects Chrome versions prior to 152.0.7977.65. A local attacker with a co-installed malicious application can potentially execute arbitrary code outside the Chrome sandbox. Google's Chromium security team rates the underlying issue as Medium, while the NVD assigns it a higher score reflecting the sandbox escape impact. The weakness is tracked as [CWE-862] Missing Authorization.

Critical Impact
A co-installed Android app can invoke CustomTabs interfaces without proper authorization checks, enabling code execution outside Chrome's sandbox on the local device.

Affected Products

Google Chrome for Android prior to 152.0.7977.65
Google Android devices with vulnerable Chrome installed
Any Android application relying on Chrome CustomTabs integrations

Discovery Timeline

2026-08-25 - CVE-2026-79286 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79286

Vulnerability Analysis

The vulnerability resides in Chrome's CustomTabs implementation on Android. CustomTabs allows other Android apps to launch a customized Chrome browser tab for rendering web content within their own user experience. The component exposes inter-process communication (IPC) surfaces that other installed apps can invoke.

Because an authorization check is missing on one of these entry points, a co-installed application can trigger privileged functionality intended only for authorized callers. The consequence is that attacker-controlled operations execute in Chrome's process context rather than being contained inside the browser sandbox. That yields code execution outside the sandbox on the affected device.

Exploitation requires local access, specifically the ability to install and run a malicious app on the same Android device. No user interaction with Chrome itself is required beyond the co-installed app invoking the exposed interface.

Root Cause

The root cause is an omitted authorization check in a CustomTabs IPC pathway. Chrome accepts a request from another local app without verifying that the caller holds the required permission or identity to invoke the operation. This maps directly to [CWE-862] Missing Authorization.

Attack Vector

An attacker publishes or sideloads a malicious Android app onto the target device. Once launched, the app issues an intent or binder call to the vulnerable CustomTabs interface in Chrome. Chrome processes the request without validating the caller, and the resulting operation escapes the browser sandbox. Additional technical detail is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2026-79286

Indicators of Compromise

Unexpected Chrome child processes spawned in response to intents from third-party Android apps
Newly installed apps that declare intents targeting androidx.browser.customtabs or Chrome package components
Chrome crash reports or ANRs correlated with binder calls originating from non-browser packages

Detection Strategies

Inventory Android endpoints and flag devices running Chrome versions earlier than 152.0.7977.65
Monitor mobile threat telemetry for apps issuing CustomTabsService bindings without a legitimate business purpose
Correlate app installation events with subsequent Chrome activity anomalies on the same device

Monitoring Recommendations

Ingest Android MDM and EMM logs into a centralized data lake to track Chrome version drift across the fleet
Alert on installation of unsigned or sideloaded APKs on managed devices
Review Google Play Protect verdicts and mobile EDR alerts referencing Chrome IPC abuse

How to Mitigate CVE-2026-79286

Immediate Actions Required

Update Google Chrome for Android to version 152.0.7977.65 or later through the Google Play Store
Enforce automatic app updates on managed Android devices via MDM policy
Restrict installation of apps from unknown sources on corporate-managed Android devices

Patch Information

Google addressed the missing authorization check in the stable channel update announced in the Google Chrome Stable Update. Chrome for Android version 152.0.7977.65 and later contains the fix. The corresponding Chromium engineering discussion is available in the Chromium Issue Tracker Entry.

Workarounds

Uninstall or disable Chrome on Android devices where updating to 152.0.7977.65 is not immediately feasible
Block sideloading and enforce Google Play Protect scanning through MDM configuration profiles
Review installed apps for those requesting CustomTabs interactions and remove any that are untrusted

bash

# Example MDM policy fragment to enforce Chrome auto-update and block unknown sources
adb shell settings put global install_non_market_apps 0
adb shell pm set-app-inactive com.android.chrome false
# Verify installed Chrome version meets the patched build
adb shell dumpsys package com.android.chrome | grep versionName