Google Chrome: Unauthorized media deletion through intent redirect

Summary

A bug in Google Chrome allows a malicious website to delete files on a user's device without permission. This could give the website more access to the user's device than it should have. To protect yourself, update to the latest version of Google Chrome.

What to do

Update google platform/packages/providers/mediaprovider to version 16-qpr2-next:2026-03-01.
Update google platform/packages/providers/mediaprovider to version 15:2026-03-01.
Update google platform/packages/providers/mediaprovider to version 16:2026-03-01.
Update google platform/packages/providers/mediaprovider to version 14:2026-03-01.

Affected software

Vendor	Product	Affected versions	Fix available
google	android	14.0	–
google	android	15.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	android	16.0	–
google	platform/packages/providers/mediaprovider	> 16-qpr2-next:0 , <= 16-qpr2-next:2026-03-01	16-qpr2-next:2026-03-01
google	platform/packages/providers/mediaprovider	> 15:0 , <= 15:2026-03-01	15:2026-03-01
google	platform/packages/providers/mediaprovider	> 16:0 , <= 16:2026-03-01	16:2026-03-01
google	platform/packages/providers/mediaprovider	> 14:0 , <= 14:2026-03-01	14:2026-03-01

Original title

In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no add...

Original description

In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

nvd CVSS3.1 8.4

Vulnerability type

CWE-59 Link Following