Google Chrome CVE-2026-79286

Exploitation requires that the target Android device has both a vulnerable version of Google Chrome (prior to 152.0.7977.65) and a malicious attacker-controlled application co-installed on the same device. The Chrome CustomTabs feature must be invoked - this is the specific component where the authorization check is absent. The attack is constrained entirely to the Android platform; Chrome on other operating systems is unaffected by this CVE. The CVSS AC:H metric confirms that the co-installed application prerequisite elevates attack complexity well beyond simple remote exploitation. CVSS PR:N indicates no system-level authentication or elevated OS privileges are required for the attacker app itself. No ongoing user interaction (UI:N) is required after the malicious app is installed. Exploitation is practically limited by the need to deliver a malicious app to the device, which typically requires either physical device access, exploitation of a permissive sideloading policy, or a social engineering campaign to induce installation from an unofficial source.

The CVSS 3.1 base score of 7.4 with vector AV:L/AC:H/PR:N/UI:N/S:U reflects a local attack requiring high complexity due to the co-installed app prerequisite, with full confidentiality, integrity, and availability impact assessed. The EPSS score of 0.13% at the 3rd percentile is a strong signal that no exploitation activity has been observed in the wild, significantly undercutting the urgency implied by the numeric CVSS score. No CISA KEV listing and no public proof-of-concept code have been identified, meaning no public exploit has been confirmed at time of analysis. The Chromium team's own Medium severity rating aligns with the practical risk profile far better than the NVD base score of 7.4 does, and security teams should weight the Chrome team's contextual assessment accordingly. The requirement for a co-installed malicious app substantially narrows the exploitable population - this is not a remote or opportunistic threat vector. Standard patch-cycle prioritization is appropriate for most organizations; emergency response posture is not warranted by current signals.

An attacker distributes a malicious Android application - potentially disguised as a utility or productivity tool - which, once co-installed on the victim's device alongside a vulnerable Chrome version, exploits the missing authorization check in the CustomTabs interface to escape Chrome's sandbox and execute arbitrary code outside it. No public proof-of-concept has been identified at time of analysis, and the high attack complexity (AC:H) reflects that the attacker must successfully deliver and install the malicious app before triggering the specific authorization gap in CustomTabs. Code execution landing outside the Chrome sandbox may enable further device compromise depending on Android OS-level permissions granted to the malicious app.