Google Chrome EUVD-2026-65789

Exploitation requires three concurrent conditions to hold simultaneously: (1) the target device runs Google Chrome for Android strictly prior to version 152.0.7977.65 - the vulnerability is Android-platform-specific and does not affect Chrome on other operating systems; (2) the user must be actively social-engineered into interacting with attacker-controlled content (UI:R), such as accepting a web-app install prompt - passive browsing without user action is insufficient; (3) a co-installed attacker-controlled or attacker-influenced application must already reside on the same Android device, which is a non-trivial prerequisite requiring a separate compromise vector or physical access. The race condition (CWE-362) introduces an additional timing dependency on the attack. No authentication is required (PR:N). The co-installed-app requirement is the primary real-world limiting factor and substantially reduces the population of exploitable targets compared to a pure remote unauthenticated flaw.

The vendor-assigned CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable flaw requiring user interaction (UI:R) with no privilege requirement (PR:N) and only limited confidentiality impact (C:L, I:N, A:N). The AC:L metric in the vendor-provided vector may understate actual complexity, since successful exploitation requires both a precise race condition timing window and the presence of a co-installed malicious app - preconditions that together suggest higher practical attack complexity. EPSS at 0.20% (10th percentile) is very low, indicating fewer than 10% of tracked CVEs carry a lower exploitation probability in the near term. There is no CISA KEV listing and no publicly known proof-of-concept code. Notably, Chromium internally rated this flaw 'High' severity, which conflicts with the CVSS 4.3 Medium score; this discrepancy likely reflects Chrome's conservative internal rating practices weighing origin policy bypass impact more heavily than CVSS base metrics capture. Overall, this is a real but low-immediate-priority vulnerability for most organizations; Android-heavy enterprise environments with sensitive web application deployments should nonetheless prioritize patching given Chrome's ubiquitous deployment footprint.

An attacker who has previously installed a malicious companion application on a victim's Android device (via phishing, sideloading, or a prior compromise) lures the user to an attacker-controlled website and social-engineers them into accepting a Progressive Web App install prompt. During the installation, the attacker exploits the race window in WebAppInstalls to have the co-installed app interfere with origin binding, causing Chrome to misapply origin policy and allowing the attacker to read resources from a victim web origin. No public proof-of-concept code has been identified at time of analysis.