CVE-2026-79152: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome on Android (versions before 152.0.7977.65) arises from incorrect authorization handling in the CustomTabs component. It enables a local attacker with a co-installed app to bypass the web origin policy, potentially compromising the security boundaries between web origins. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but the patch status is not confirmed in the provided data. The vendor advisory URL is given but does not explicitly confirm remediation details.

Successful exploitation allows a local attacker with a co-installed app to bypass the web origin policy in Chrome CustomTabs on Android, potentially leading to unauthorized access to web content, data leakage, or manipulation of web sessions. The high CVSS score indicates critical impact on confidentiality, integrity, and availability of affected systems.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with co-installed apps and avoid installing untrusted applications that may exploit this vulnerability.