Google Chrome Android CVE-2026-7941

A Chrome Extension must be installed on the target Android device - the vulnerability cannot be exploited through a web page or other remote vector. The extension must be crafted to contain or deliver the malicious input payload that triggers the insufficient validation in Chrome's Android mobile implementation. User interaction is required both to install the extension initially and to trigger interaction with the compromised content. The vulnerability is specific to the Android version of Chrome and does not inherently affect other browsers or Chrome on other platforms (though desktop Chrome has a separate but related issue). Default Chrome installations without extensions are not vulnerable to this specific attack chain.

The CVSS v3.1 score of 4.4 (Medium) reflects a local attack vector (AV:L) with low complexity (AC:L), no privilege requirement (PR:N), and required user interaction (UI:R), resulting in low confidentiality and integrity impact (C:L, I:L) with no availability impact (A:N). The local attack vector significantly limits real-world risk compared to network-based vulnerabilities, as the attacker must already have some form of access to the device or convince a user to install a malicious extension. The requirement for user interaction (UI:R) further constrains exploitation - the user must interact with the crafted extension or content. However, the integrity impact of injecting arbitrary scripts or HTML is concerning in the context of sensitive web applications (banking, email, social media) accessed through Chrome on Android. CVSS data does not include EPSS or KEV status confirmation, so exploitation probability in the wild remains unconfirmed. The Chromium security severity designation as 'Medium' aligns with the CVSS score and suggests this is a real vulnerability but not in the critical exploitation category. Defenders should prioritize patch deployment but this does not warrant emergency response procedures.

An attacker creates a malicious Chrome Extension and tricks a user into installing it on their Android device. Once installed, the extension exploits insufficient input validation in Chrome's mobile browser engine to inject arbitrary JavaScript or HTML that executes in the context of sensitive web applications (such as email or banking sites). The injected script can then steal session tokens, redirect users to phishing pages, or modify page content without triggering typical security warnings, because the injection occurs at a layer that bypasses same-origin policy protections.