EUVD-2026-40733
GHSA-9xcq-v4mx-9rf3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered SOP bypass requires active victim interaction to load a crafted page; only limited cross-origin integrity impact, with no confidentiality or availability consequence.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in Google Chrome's CustomTabs component on Android (versions prior to 150.0.7871.47) permits remote attackers to perform limited cross-origin integrity violations by directing a victim to a crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's CustomTabs implementation incorrectly validates or enforces origin boundaries when rendering attacker-controlled content. No active exploitation has been confirmed (not in CISA KEV) and the EPSS score of 0.18% (8th percentile) reflects very low observed exploitation probability, consistent with the Low severity rating assigned by the Chromium security team.
Technical ContextAI
CustomTabs is a Chrome for Android API feature that allows Android applications to embed and present web content within a browser-like interface while reusing Chrome's rendering engine, cookies, and permission model. The same-origin policy (SOP) is a critical browser security boundary preventing scripts or resources from one origin from reading or modifying data belonging to a different origin. CWE-346 (Origin Validation Error) identifies the root cause as a failure in the implementation's logic to correctly validate the origin of requests or content within the CustomTabs context. This class of flaw typically arises when the integration layer between the native Android app shell and the browser's web security model improperly handles cross-origin navigations, intent-based redirects, or custom URL schemes, allowing an attacker-controlled page to influence content or state from a different origin. The vulnerability is scoped to Chrome on Android and does not affect desktop Chrome builds.
RemediationAI
Update Chrome for Android to version 150.0.7871.47 or later via the Google Play Store. The patch is confirmed available per the official Google Chrome Releases advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For Android app developers who integrate CustomTabs, auditing custom URL scheme handlers, intent filters, and cross-origin navigation logic in their app's CustomTabs integration is advisable as a supplementary measure. If immediate update is not possible - for example, in managed enterprise Android deployments - a compensating control is to restrict or disable in-app browser features that rely on CustomTabs for sensitive authenticated sessions, routing such flows through the full Chrome browser app instead, which reduces the attack surface at the cost of a degraded user experience. No workaround fully eliminates the risk in the absence of the patch.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today