Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via… (CVE-2026-78949)

CVE-2026-78949 describes a security flaw in Google Chrome on Android versions before 152.0.7977.65 where an observable discrepancy in the CustomTabs feature permits a local attacker, through a co-installed app, to access cross-origin data. This vulnerability is categorized under CWE-203 (Observable Discrepancy) and has a low CVSS 3.1 base score of 2.9, indicating limited impact. The attack vector requires local access with high attack complexity and no privileges or user interaction, resulting in limited confidentiality impact and no integrity or availability impact.

The vulnerability allows a local attacker to obtain some cross-origin data from Google Chrome's CustomTabs on Android devices running affected versions. The confidentiality impact is limited, and there is no impact on integrity or availability. No known exploitation in the wild has been reported.

A fix is available in Google Chrome version 152.0.7977.65. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. No additional mitigation steps are indicated.