EUVD-2026-65890
GHSA-63ch-44jp-r3mq
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Local vector and high complexity reflect the co-installed app prerequisite; confidentiality-only impact matches the data-disclosure nature with no integrity or availability consequence.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)
AnalysisAI
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must be simultaneously present for exploitation: Chrome for Android must be running a version prior to 152.0.7977.65, and an attacker-controlled application must be co-installed on the same Android device as Chrome. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N yields a score of 5.1, which accurately reflects the narrow but real threat: local access is required, complexity is high, and impact is confined to confidentiality. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker distributes a malicious Android application through a sideloading channel or social-engineering campaign, convincing the target to install it alongside Chrome on their device. Once co-installed, the malicious app invokes the Chrome CustomTabs interface and exploits the missing authorization check to read sensitive information - such as URLs being browsed, session tokens, or other web content metadata - without Chrome verifying the caller's entitlement. … |
| Remediation | Update Google Chrome for Android to version 152.0.7977.65 or later, which is the confirmed fixed release per the Chrome stable channel advisory at http://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today