Google Chrome CVE-2026-79086

Two specific conditions must be simultaneously present for exploitation: Chrome for Android must be running a version prior to 152.0.7977.65, and an attacker-controlled application must be co-installed on the same Android device as Chrome. The high attack complexity (AC:H) in the CVSS vector directly reflects the co-installed app requirement as a special condition. No OS-level privileges are required by the attacking application (PR:N) beyond what a normally installed Android app possesses. Desktop Chrome (Windows, macOS, Linux) is not affected. Impact is strictly limited to confidentiality (C:H); integrity and availability are unaffected (I:N/A:N). Exploitation is further constrained by the need for the victim to have the vulnerable Chrome version active and for the attacker app to successfully invoke the CustomTabs interface in the relevant manner.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 5.1, which accurately reflects the narrow but real threat: local access is required, complexity is high, and impact is confined to confidentiality. The high attack complexity (AC:H) is the key limiting factor - successful exploitation demands that an attacker-controlled application already be co-installed on the victim's device, a non-trivial prerequisite that prevents mass or automated exploitation. The EPSS score of 0.17% at the 6th percentile is consistent with this assessment and confirms that exploitation in the broader ecosystem is unlikely. There is no CISA KEV listing and no public exploit code identified at time of analysis. The combination of local-only vector, high complexity, Android-platform specificity, and the absence of any exploitation signals means this vulnerability does not rise to urgent priority for most enterprise defenders; however, organizations managing large Android fleets with permissive app-install policies should prioritize patching, as the confidentiality impact (C:H) could expose sensitive session data if the attack conditions are met.

An attacker distributes a malicious Android application through a sideloading channel or social-engineering campaign, convincing the target to install it alongside Chrome on their device. Once co-installed, the malicious app invokes the Chrome CustomTabs interface and exploits the missing authorization check to read sensitive information - such as URLs being browsed, session tokens, or other web content metadata - without Chrome verifying the caller's entitlement. No public exploit code is known at time of analysis, and the high attack complexity makes this primarily a targeted rather than opportunistic threat.