Google Chrome CVE-2026-79222

Exploitation requires two concrete prerequisites: a malicious application must be co-installed on the target Android device alongside an application that invokes Chrome CustomTabs, and the victim must actively use the CustomTab session (UI:R). The vulnerability is Android-platform-specific and does not affect Chrome on Windows, macOS, Linux, or iOS. Exploitation is bounded by the attacker's need to achieve co-installation - requiring social engineering, a managed app store compromise, or physical device access - and by user interaction triggering the CustomTab flow. The confidentiality impact is limited to web origin policy bypass (C:L); no integrity or availability impact has been identified. Chrome 152.0.7977.65 and later are not affected.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) is in tension with the vulnerability description, which explicitly identifies a local attacker operating via a co-installed application - a condition more consistent with AV:L and AC:H than a straightforward network-accessible, low-complexity flaw; this discrepancy should be verified against the Chromium issue tracker (https://issues.chromium.org/issues/496195129). The EPSS score of 0.14% (3rd percentile) corroborates a low exploitation probability in practice, and the vulnerability carries no CISA KEV listing and no known public proof-of-concept. The impact ceiling is limited confidentiality exposure (C:L) with no integrity or availability consequence, meaning real-world damage potential is bounded even if exploited. In aggregate, this is a routine patch-cycle priority rather than an emergency response item - organizations should update Chrome on Android as part of normal fleet maintenance.

An attacker publishes a malicious Android application and persuades a victim to install it on a device that already runs an application using Chrome CustomTabs for web-based authentication or sensitive content. When the victim interacts with a CustomTab session in the legitimate app, the malicious co-installed app exploits the authorization flaw to read cross-origin web content or session data that should be isolated by origin policy. No public proof-of-concept has been identified at time of analysis.