EUVD-2026-65789
Race Condition (CWE-362)
GHSA-8r42-2qq9-jf3w
4.3
CVSS 3.1 · Vendor: Chrome
Share
Severity by source
Vendor (Chrome)
PRIMARY
4.3
MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
vuln.today
AI
3.1
LOW
AC:H reflects both the race condition timing dependency and the co-installed-app precondition; all other metrics align with vendor vector; no integrity or availability impact observed.
3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Lifecycle Timeline
4
Analysis Generated
Aug 28, 2026 - 00:25 vuln.today
CVSS changed
Aug 28, 2026 - 00:22 NVD
4.3 (MEDIUM)
CVE Published
Aug 25, 2026 - 20:10 cve.org
MEDIUM 4.3
CVE Published
Aug 25, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
DescriptionCVE.org
Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: High)
AnalysisAI
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Plant co-installed malicious app on victim Android device
Delivery
Lure user to attacker-controlled website via social engineering
Exploit
Trigger Progressive Web App install prompt (user interaction)
Execution
Race condition window opens in WebAppInstalls subsystem
Persist
Co-installed app interferes with origin policy enforcement
Impact
Attacker reads cross-origin resources from victim web origin
Access
Plant co-installed malicious app on victim Android device
Delivery
Lure user to attacker-controlled website via social engineering
Exploit
Trigger Progressive Web App install prompt (user interaction)
Execution
Race condition window opens in WebAppInstalls subsystem
Persist
Co-installed app interferes with origin policy enforcement
Impact
Attacker reads cross-origin resources from victim web origin
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions to hold simultaneously: (1) the target device runs Google Chrome for Android strictly prior to version 152.0.7977.65 - the vulnerability is Android-platform-specific and does not affect Chrome on other operating systems; (2) the user must be actively social-engineered into interacting with attacker-controlled content (UI:R), such as accepting a web-app install prompt - passive browsing without user action is insufficient; (3) a co-installed attacker-controlled or attacker-influenced application must already reside on the same Android device, which is a non-trivial prerequisite requiring a separate compromise vector or physical access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable flaw requiring user interaction (UI:R) with no privilege requirement (PR:N) and only limited confidentiality impact (C:L, I:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has previously installed a malicious companion application on a victim's Android device (via phishing, sideloading, or a prior compromise) lures the user to an attacker-controlled website and social-engineers them into accepting a Progressive Web App install prompt. During the installation, the attacker exploits the race window in WebAppInstalls to have the co-installed app interfere with origin binding, causing Chrome to misapply origin policy and allowing the attacker to read resources from a victim web origin. … |
| Remediation | Update Google Chrome for Android to version 152.0.7977.65 or later via the Google Play Store; this is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).