CVE-2026-7941: Google Chrome XSS Vulnerability on Android

CVE-2026-7941 Overview

CVE-2026-7941 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome on Android. The flaw stems from insufficient validation of untrusted input in the Mobile component. A local attacker can inject arbitrary scripts or HTML through a crafted Chrome Extension. Google addressed the issue in Chrome version 148.0.7778.96.

The vulnerability is tracked under [CWE-20] Improper Input Validation. Chromium classifies its security severity as Medium. Exploitation requires user interaction, specifically the installation of a malicious extension on the affected mobile browser.

Critical Impact

Successful exploitation enables script or HTML injection in the context of arbitrary web origins, breaking the same-origin policy and exposing user session data on Chrome for Android.

Affected Products

• Google Chrome on Android prior to 148.0.7778.96
• Google Android platforms running vulnerable Chrome builds
• Chrome Extension surface on the mobile browser

Discovery Timeline

• 2026-05-06 - CVE-2026-7941 published to NVD
• 2026-05-06 - Last updated in NVD database
• May 2026 - Google releases stable channel update addressing the issue

Technical Details for CVE-2026-7941

Vulnerability Analysis

The vulnerability is a Universal Cross-Site Scripting (UXSS) flaw in the Mobile component of Chrome on Android. Chrome fails to properly validate untrusted input supplied through a crafted Chrome Extension. As a result, attacker-controlled content is processed in a context that permits script or HTML execution outside the extension's intended scope.

UXSS differs from traditional XSS because the injection occurs at the browser layer rather than within a single web application. The injected script can run against arbitrary origins loaded in the browser. This bypasses the same-origin policy that web applications rely on for isolation.

The attack path requires the user to install a malicious or compromised extension. Once installed, the extension supplies crafted input that the Mobile component fails to sanitize. The browser then renders attacker payloads in unintended contexts.

Root Cause

The root cause is missing or incomplete input validation in the Mobile code path that handles data originating from Chrome Extensions. The component trusts content that should be treated as attacker-controlled. This allows extension-supplied strings to reach HTML or script parsing routines without sanitization.

Attack Vector

Exploitation requires local access and user interaction. The attacker must convince the victim to install a crafted Chrome Extension on Chrome for Android. Once active, the extension issues input that triggers the UXSS condition. No elevated privileges are required, and the impact is limited to confidentiality and integrity of browser-rendered content. Refer to the Chromium Issue Tracker Entry for additional context.

Detection Methods for CVE-2026-7941

Indicators of Compromise

• Installation of unverified or sideloaded Chrome Extensions on Android devices.
• Unexpected script execution or DOM modification across unrelated web origins inside Chrome for Android.
• Outbound network requests from the browser to attacker-controlled domains correlated with extension activity.

Detection Strategies

• Inventory installed Chrome Extensions across managed mobile devices and flag those not on an approved list.
• Monitor Chrome version telemetry on Android endpoints to identify versions earlier than 148.0.7778.96.
• Review browser logs and mobile threat defense telemetry for anomalous extension behavior or origin-crossing script activity.

Monitoring Recommendations

• Enforce mobile device management (MDM) policies that report Chrome version and installed extensions.
• Alert on installation of extensions outside the Chrome Web Store or from unknown publishers.
• Track Google Chrome stable channel advisories via the Google Chrome Update Announcement feed for follow-up fixes.

How to Mitigate CVE-2026-7941

Immediate Actions Required

• Update Chrome on Android to version 148.0.7778.96 or later through the Google Play Store.
• Audit installed Chrome Extensions and remove any that are unnecessary or untrusted.
• Restrict extension installation on managed devices using MDM controls where supported.

Patch Information

Google released the fix in Chrome 148.0.7778.96 for the stable channel. Organizations should validate deployment through device management telemetry. Details are documented in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry.

Workarounds

• Block sideloading of Chrome Extensions through enterprise mobility policies until patching is verified.
• Limit Chrome Extension permissions on Android and disable extensions that request broad host access.
• Educate users to avoid installing extensions from untrusted sources while updates roll out.

# Configuration example: enforce minimum Chrome version via MDM compliance rule
# Pseudocode for an MDM policy expression
require app.package == "com.android.chrome"
require app.version >= "148.0.7778.96"
action noncompliant: block_corporate_access