CVE-2026-78949: Observable discrepancy in Google Chrome

CVE-2026-78949 is a vulnerability in Google Chrome on Android affecting versions prior to 152.0.7977.65. It involves an observable discrepancy in the CustomTabs feature that allows a local attacker, via a co-installed app, to access cross-origin data that should otherwise be restricted. The vulnerability has a CVSS 3.1 base score of 2.9, indicating low severity, with an attack vector limited to local access and high attack complexity. The issue does not require privileges or user interaction and impacts confidentiality only.

The vulnerability allows a local attacker with a co-installed app to obtain cross-origin data from Chrome's CustomTabs, potentially exposing sensitive information across origins. The impact is limited to confidentiality with no integrity or availability effects. The attack requires local access and has high complexity, reducing the likelihood of exploitation. No known exploits are currently reported in the wild.

Google has released a stable channel update for Chrome that addresses this vulnerability in version 152.0.7977.65. Users and administrators should update Chrome on Android to version 152.0.7977.65 or later to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.