Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to… (CVE-2026-79046)

CVE-2026-79046 describes a race condition in the permissions component of Google Chrome on Android platforms before version 152.0.7977.65. This flaw enables a remote attacker, through social engineering, to bypass the web origin policy by delivering a specially crafted HTML page. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use Race Condition) and has a CVSS v3.1 base score of 4.3, indicating moderate impact primarily on confidentiality with no impact on integrity or availability.

The vulnerability allows an attacker to bypass the web origin policy, potentially exposing limited confidential information from web origins that should be isolated. There is no impact on data integrity or system availability. Exploitation requires user interaction via social engineering. No known exploits are reported in the wild.

A fix is available in Google Chrome version 152.0.7977.65 and later. Users and administrators should update affected Chrome installations on Android to this version or newer to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the update on client devices.