CVE-2026-79089: Race condition in Google Chrome

This vulnerability is a race condition (CWE-367) in the Transactions Platform of Google Chrome on Android devices before version 152.0.7977.65. It enables a remote attacker to bypass system access restrictions by tricking a user into interacting with a maliciously crafted HTML page. The CVSS 3.1 base score is 5.3 (medium severity) with vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild have been reported. The vulnerability affects Android Chrome versions prior to 152.0.7977.65.

An attacker can bypass system access restrictions on affected Chrome for Android versions by leveraging this race condition through social engineering. The integrity of the system can be compromised, but confidentiality and availability are not affected. The vulnerability requires user interaction and has a high attack complexity, reducing the likelihood of widespread exploitation.

Users should update Google Chrome on Android to version 152.0.7977.65 or later to remediate this vulnerability. Although no explicit patch link is provided, the affected version indicates the fix is included in 152.0.7977.65. No additional mitigation steps are specified by the vendor. There are no known exploits in the wild, so immediate emergency response is not required.