Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to… (CVE-2026-79117)

CVE-2026-79117 is a race condition vulnerability in the WebAppInstalls feature of Google Chrome on Android devices before version 152.0.7977.65. The issue allows a remote attacker to bypass the web origin policy by exploiting timing conditions involving a co-installed application, facilitated by social engineering. The vulnerability is classified under CWE-362 (Race Condition) and has a CVSS 3.1 base score of 4.3 (medium severity). There is no information about an available patch or official fix at this time.

The vulnerability could allow a remote attacker to bypass the web origin policy, potentially enabling unauthorized access to web content or data isolation boundaries. However, the impact is limited to confidentiality (C:L) with no integrity or availability impact. Exploitation requires user interaction (UI:R) and no privileges (PR:N). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with social engineering attempts and avoid installing untrusted co-installed applications that might leverage this vulnerability.