Google Chrome Android EUVD-2026-65951

Exploitation requires two concurrent conditions: (1) a malicious or attacker-controlled Android application must be co-installed on the same device as a vulnerable version of Google Chrome (prior to 152.0.7977.65), and (2) the victim user must actively trigger a Chrome CustomTabs session - for example, by tapping a link inside another app that opens content in the CustomTabs browser view. The flaw is platform-specific to Android because CustomTabs is an Android-exclusive API. Exploitation is constrained to the local device context (AV:L) and is not remotely triggerable over a network without first achieving app installation. What limits exploitation: the attacker must achieve app installation on the target device (requires social engineering, supply chain compromise, or physical access); user interaction (UI:R) is mandatory as the victim must use CustomTabs; and the attack does not grant write access or availability impact - only cross-origin data reads. This is not a default-configuration remote attack; it depends on the presence of a co-installed malicious app.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N yields a base score of 5.5 (Medium). The local attack vector (AV:L) is the primary risk limiter: exploitation requires an attacker-controlled or malicious co-installed app to already be present on the victim's Android device, which significantly narrows the attacker population compared to a network-exploitable flaw. User interaction (UI:R) further constrains opportunistic exploitation, as the victim must actively trigger a CustomTabs session. The High confidentiality impact (C:H) reflects that cross-origin data - potentially including authentication tokens, session cookies, or sensitive page content - could be exposed, but integrity and availability are unaffected. The EPSS score of 0.13% (3rd percentile) is consistent with the attack complexity involved and the absence of any known exploit code or KEV listing; this low probability signal aligns with the local-access requirement and suggests no widespread active exploitation campaign. The SSVC signals (no exploitation, not trivially automatable due to device-local prerequisites, partial technical impact) reinforce a 'monitor and patch on normal cycle' posture for most organizations rather than emergency response. There is no conflict between the CVSS vector and the description - both describe a local, co-installed-app-mediated attack.

An attacker distributes a malicious Android application - potentially disguised as a utility or bundled with a legitimate app - that is co-installed on the victim's device alongside Google Chrome. When the victim uses a legitimate app that invokes Chrome CustomTabs to open a web page (such as an OAuth login flow or a banking portal), the malicious co-installed app exploits the cross-origin isolation failure to read sensitive data from that browsing session, such as authentication tokens or page content. No public proof-of-concept code has been identified at time of analysis, meaning this attack would currently require bespoke development.