What is the CVSS score of EUVD-2026-65789?

EUVD-2026-65789 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for EUVD-2026-65789?

Yes, a patch is available for EUVD-2026-65789. Update the affected software to the latest version immediately.

Google Chrome EUVD-2026-65789

| CVE-2026-79117 MEDIUM

Race Condition (CWE-362)

2026-08-25 Chrome

GHSA-8r42-2qq9-jf3w

Google Race Condition Authentication Bypass

4.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

AC:H reflects both the race condition timing dependency and the co-installed-app precondition; all other metrics align with vendor vector; no integrity or availability impact observed.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 28, 2026 - 00:25 vuln.today

CVSS changed

Aug 28, 2026 - 00:22 NVD

4.3 (MEDIUM)

CVE Published

Aug 25, 2026 - 20:10 cve.org

MEDIUM 4.3

CVE Published

Aug 25, 2026 - 20:10 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: High)

AnalysisAI

Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Plant co-installed malicious app on victim Android device

Delivery

Lure user to attacker-controlled website via social engineering

Exploit

Trigger Progressive Web App install prompt (user interaction)

Execution

Race condition window opens in WebAppInstalls subsystem

Persist

Co-installed app interferes with origin policy enforcement

Impact

Attacker reads cross-origin resources from victim web origin

Access

Plant co-installed malicious app on victim Android device

Delivery

Lure user to attacker-controlled website via social engineering

Exploit

Trigger Progressive Web App install prompt (user interaction)

Execution

Race condition window opens in WebAppInstalls subsystem

Persist

Co-installed app interferes with origin policy enforcement

Impact

Attacker reads cross-origin resources from victim web origin

Vulnerability AssessmentAI

Exploitation	Exploitation requires three concurrent conditions to hold simultaneously: (1) the target device runs Google Chrome for Android strictly prior to version 152.0.7977.65 - the vulnerability is Android-platform-specific and does not affect Chrome on other operating systems; (2) the user must be actively social-engineered into interacting with attacker-controlled content (UI:R), such as accepting a web-app install prompt - passive browsing without user action is insufficient; (3) a co-installed attacker-controlled or attacker-influenced application must already reside on the same Android device, which is a non-trivial prerequisite requiring a separate compromise vector or physical access. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The vendor-assigned CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable flaw requiring user interaction (UI:R) with no privilege requirement (PR:N) and only limited confidentiality impact (C:L, I:N, A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who has previously installed a malicious companion application on a victim's Android device (via phishing, sideloading, or a prior compromise) lures the user to an attacker-controlled website and social-engineers them into accepting a Progressive Web App install prompt. During the installation, the attacker exploits the race window in WebAppInstalls to have the co-installed app interfere with origin binding, causing Chrome to misapply origin policy and allowing the attacker to read resources from a victim web origin. …
Remediation	Update Google Chrome for Android to version 152.0.7977.65 or later via the Google Play Store; this is confirmed as the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report.