Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-79152: Chrome for Android allows co-installed app to bypass site restrictions
CVE-2026-79152 · published 9 days ago
Summary
If you use Google Chrome on Android versions before 152.0.7977.65, a malicious app installed on the same device could trick Chrome into ignoring its normal website security rules. This could let the app read or interact with data from other web sites the user visits. Update Chrome to the latest version or remove untrusted apps to stay safe.
What to do
- Update google chrome to version 152.0.7977.65 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium | All versions |
| Debian:13 | debian | chromium | All versions |
| Debian:14 | debian | chromium | All versions |
| – | chrome | < 152.0.7977.65 | |
| Debian:11 | debian | chromium | All versions |
Original advisory text
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity:...
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
Severity
9.8
Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS <1%
Type
CWE-863Incorrect Authorization
Timeline
Published25 Aug 2026
Updated2 Sep 2026
First seen26 Aug 2026
Monitor software like this
Free during beta