CVE-2026-91717: Google Chrome Information Disclosure Flaw

CVE-2026-91717 Overview

CVE-2026-91717 is a missing authorization vulnerability [CWE-862] in Google Chrome on Android prior to version 153.0.8010.47. The flaw allows a local attacker to obtain sensitive information through a co-installed application on the same Android device. Google classifies the Chromium security severity as High, while the NVD CVSS score reflects a local attack vector with high attack complexity. The vulnerability affects Chrome's Android-specific authorization checks between application components, enabling information disclosure to unprivileged co-installed apps without user interaction.

Critical Impact
A malicious app installed alongside Chrome on Android can access sensitive browser data due to missing authorization controls, exposing user information without prompting or interaction.

Affected Products

Google Chrome for Android prior to 153.0.8010.47
Google Android (as the host operating system for the affected Chrome build)
Chromium-based browsers on Android that share the affected component

Discovery Timeline

2026-09-15 - CVE-2026-91717 published to NVD
2026-09-17 - Last updated in NVD database
Stable Channel Update - Google releases fixed version 153.0.8010.47 via the Chrome Releases blog

Technical Details for CVE-2026-91717

Vulnerability Analysis

The vulnerability stems from missing authorization enforcement [CWE-862] in a Chrome Android component that exposes functionality or data to other applications on the device. Android applications communicate through Inter-Process Communication (IPC) mechanisms such as Intents, Content Providers, and exported Services. When an exposed component fails to verify that a caller holds the required permission or identity, any co-installed app can invoke it and retrieve information intended only for Chrome itself.

According to the NVD description, exploitation results in disclosure of sensitive information from Chrome to a co-installed attacker-controlled app. The confidentiality impact is High, while integrity and availability are unaffected.

Root Cause

The root cause is an authorization check that is either absent or incorrectly scoped on a Chrome Android surface reachable from other applications. Under Android's package sandbox model, each app runs with its own UID, and cross-app access must be gated by signature-level permissions, checkCallingPermission calls, or explicit UID validation. When these gates are missing, sensitive Chrome data becomes reachable from any unprivileged local package.

Attack Vector

Exploitation requires the attacker to have code execution on the same device through an installed application. The malicious app targets the exposed Chrome component using standard Android IPC calls. The high attack complexity reflects conditions the attacker must satisfy, such as timing, specific Chrome state, or particular app installation sequences. No user interaction and no elevated privileges are required. Technical specifics are tracked in the Chromium Issue Tracker #549225472.

Detection Methods for CVE-2026-91717

Indicators of Compromise

Presence of Chrome for Android at versions earlier than 153.0.8010.47 on managed mobile devices
Unexpected co-installed applications issuing Intents or Content Provider queries targeting Chrome package components
Mobile telemetry showing non-browser apps reading Chrome-associated data paths or IPC endpoints

Detection Strategies

Inventory Chrome for Android versions across the mobile fleet using MDM or UEM reporting and flag any build below 153.0.8010.47
Review installed application lists on sensitive devices for untrusted or sideloaded packages that could act as the co-installed attacker
Monitor mobile threat defense (MTD) logs for anomalous IPC traffic between third-party apps and com.android.chrome

Monitoring Recommendations

Enable mobile application risk scoring to identify apps with broad IPC or query-all-packages behavior
Track Chrome update compliance as a continuous metric and alert on devices that fall behind the fixed version
Correlate app installation events with subsequent Chrome data access patterns in centralized security telemetry

How to Mitigate CVE-2026-91717

Immediate Actions Required

Update Google Chrome on Android to version 153.0.8010.47 or later through the Google Play Store
Push forced update policies via MDM for managed Android devices and validate installed versions
Remove untrusted, sideloaded, or unnecessary applications from devices that store or access sensitive data through Chrome

Patch Information

Google addressed the vulnerability in Chrome for Android build 153.0.8010.47, distributed through the Stable Channel update announced on the Chrome Releases blog. The fix restores authorization enforcement on the affected component so co-installed apps can no longer retrieve sensitive Chrome data.

Workarounds

Restrict installation of third-party apps on devices that handle sensitive browsing sessions until the patch is applied
Enforce Google Play Protect and block sideloading through MDM configuration profiles
Use work profiles or dedicated managed Chrome deployments to isolate sensitive browsing from personal apps

bash

# Example: verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Example MDM query target (pseudo): flag devices where
# com.android.chrome versionName < 153.0.8010.47