Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via… (CVE-2026-79222)

CVE-2026-79222 describes an authorization flaw in the CustomTabs feature of Google Chrome on Android devices before version 152.0.7977.65. This flaw enables a local attacker, through a co-installed application, to bypass the web origin policy, which is designed to isolate web content from different origins. The vulnerability is categorized under CWE-863 (Incorrect Authorization). The CVSS v3.1 base score is 4.3, reflecting a moderate impact primarily on confidentiality with no impact on integrity or availability. No known exploits are reported in the wild, and no vendor patch or advisory details are provided in the input data.

The vulnerability allows a local attacker with a co-installed app to bypass the web origin policy, potentially leading to unauthorized access to web content that should be isolated by origin. The impact is limited to confidentiality with no reported effects on integrity or availability. The CVSS score of 4.3 indicates a moderate risk level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users and administrators should monitor official Google Chrome security advisories for updates. Until a fix is available, limiting installation of untrusted local apps may reduce exposure.