Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via… (CVE-2026-78936)

CVE-2026-78936 describes an information disclosure vulnerability in Google Chrome's CustomTabs feature on Android devices before version 152.0.7977.65. This flaw allows a local attacker, leveraging a co-installed app, to observe discrepancies that lead to cross-origin data leakage. The vulnerability is rated low severity with a CVSS 3.1 score of 2.9, reflecting limited impact and high attack complexity. No active exploitation has been reported, and the issue is specific to local attacker scenarios.

The vulnerability enables a local attacker with a co-installed app to access cross-origin data that should otherwise be isolated, potentially exposing sensitive information. The impact is limited to confidentiality (partial data disclosure) with no integrity or availability effects. The attack requires local access and high attack complexity, reducing the overall risk.

Users should update Google Chrome on Android to version 152.0.7977.65 or later, where this vulnerability is fixed. Since no official patch links are provided, verify the update availability through official Google Chrome release channels. No additional mitigation is indicated by the vendor advisory. Monitoring for co-installed apps with suspicious behavior may reduce risk but is not a direct fix.