EUVD-2026-65828
GHSA-vwc3-p989-3gj3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Co-installed app requirement sets AV:L and AC:H; user must interact with CustomTab (UI:R); impact limited to partial confidentiality with no integrity or availability consequence.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)
AnalysisAI
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: a malicious application must be co-installed on the target Android device alongside an application that invokes Chrome CustomTabs, and the victim must actively use the CustomTab session (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) is in tension with the vulnerability description, which explicitly identifies a local attacker operating via a co-installed application - a condition more consistent with AV:L and AC:H than a straightforward network-accessible, low-complexity flaw; this discrepancy should be verified against the Chromium issue tracker (https://issues.chromium.org/issues/496195129). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes a malicious Android application and persuades a victim to install it on a device that already runs an application using Chrome CustomTabs for web-based authentication or sensitive content. When the victim interacts with a CustomTab session in the legitimate app, the malicious co-installed app exploits the authorization flaw to read cross-origin web content or session data that should be isolated by origin policy. … |
| Remediation | Update Google Chrome on Android to version 152.0.7977.65 or later, which contains the vendor-released patch per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today