Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the… (CVE-2026-79044)

CVE-2026-79044 describes a missing authorization issue in the WebAppInstalls feature of Google Chrome on Android before version 152.0.7977.65. This flaw enables a remote attacker, who has already compromised the renderer process, to access sensitive information by leveraging a specially crafted HTML page. The vulnerability is classified under CWE-862 (Missing Authorization) and has a CVSS v3.1 base score of 5.3, indicating moderate severity. There is no indication of known exploits in the wild or available patches from the provided data.

An attacker who has compromised the renderer process can exploit this vulnerability to obtain sensitive information from the affected Chrome browser on Android. The impact is limited to information disclosure without integrity or availability effects. The CVSS vector indicates that the attack requires user interaction and has a high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor official Google Chrome security advisories for updates. Until a fix is available, limiting exposure to untrusted content and avoiding compromise of the renderer process are recommended.