CVE-2026-79286: Missing authorization in Google Chrome

CVE-2026-79286 is a vulnerability in Google Chrome on Android involving missing authorization checks in the CustomTabs component. This flaw allows a local attacker, leveraging a co-installed app, to potentially execute arbitrary code outside the sandbox environment. The vulnerability affects versions prior to 152.0.7977.65. The CVSS 3.1 base score is 7.4, with attack vector local, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor advisory link is provided but does not explicitly confirm patch status.

Successful exploitation could allow a local attacker with a co-installed app to execute arbitrary code outside the sandbox, potentially compromising the confidentiality, integrity, and availability of the affected device. This elevates the risk of unauthorized code execution and system compromise on affected Android devices running vulnerable Chrome versions.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html for current remediation guidance. Users should update Google Chrome on Android to version 152.0.7977.65 or later once confirmed to be fixed. Until then, limit installation of untrusted co-installed apps to reduce risk.