EUVD-2026-66080
GHSA-hc64-8gxw-rx5r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessTrick user into installing malicious app
-
DeliveryCo-installed app invokes Chrome CustomTabs
-
ExploitAbuse incorrect authorization check
-
ExecutionBypass web origin policy
-
ImpactAccess cross-origin web content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a second, attacker-controlled application to be co-installed on the same Android device as Chrome (versions below 152.0.7977.65); the attack is executed locally by that app against Chrome's CustomTabs component, not remotely over the network. Limiting factors: the victim must first install the malicious app (social engineering or a trojanized app), the attack is confined to Android Chrome builds prior to 152.0.7977.65, and it does not work against a device without the hostile co-installed app - so despite the network-style CVSS vector, real exploitation is gated on local app presence. |
| Impact | The signals conflict sharply and must be read together. The supplied CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) implies remote, unauthenticated, network-borne critical impact - but the NVD description, the Chromium 'Low' severity rating, and the phrase 'local attacker ... via a co-installed app' all indicate a LOCAL attack requiring a malicious application already installed on the target device, so the 9.8/AV:N is almost certainly mis-scored and should not drive prioritization. Supporting the lower real-world urgency: EPSS is 0.11% (2nd percentile), the CVE is not in CISA KEV, SSVC exploitation status is 'none', and no POC is referenced. Counterweight: SSVC lists Automatable=yes and Technical Impact=total, meaning that IF an attacker gets a hostile app onto the device the origin bypass could be reliably automated. Net assessment: this is a genuine but lower-tier mobile-browser issue whose severity depends entirely on the co-installed-app precondition, not the inflated network CVSS; patch on the normal Chrome auto-update cadence rather than as an emergency. |
| Exploit ScenarioDerived | An attacker convinces the victim to install a benign-looking Android app that is co-installed alongside Chrome. Once present, that app abuses the CustomTabs authorization flaw to bypass the web origin policy and read or interact with content bound to a different web origin the user is signed into. No network-based remote trigger is involved and no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Web origin policy bypass in Google Chrome for Android before 152.0.7977.65 lets a malicious co-installed app abuse the CustomTabs component to escape same-origin restrictions and access content it should not. The flaw is a local privilege/authorization issue (Chromium-rated Low severity) requiring a second attacker-controlled app already present on the device; no public exploit has been identified and EPSS probability is very low (0.11%).
RemediationAI
Vendor-released patch: 152.0.7977.65 - update Chrome for Android to 152.0.7977.65 or later via Google Play, which for most users happens automatically. Confirm the installed version on managed fleets and force-update devices pinned to older builds. Because exploitation requires a malicious co-installed app, effective compensating controls are to restrict app installation to vetted sources (enforce Play Protect / block sideloading and unknown-source installs via MDM) and to remove untrusted apps; the trade-off is reduced user flexibility to install apps outside the managed catalog. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html and the Chromium issue at https://issues.chromium.org/issues/533083384.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CustomTabs is Chrome's embedded-browser surface that lets Android apps launch web content inside a Chrome-backed tab while sharing cookies, sessions, and origin state with the full browser. The root cause is CWE-863 (Incorrect Authorization): the CustomTabs authorization logic does not correctly enforce the web origin boundary when interacting with another installed application, allowing that app to act across origins it should be isolated from. Because CustomTabs bridges native Android app context and web origin context, an authorization gap there can leak or manipulate data tied to a different web origin. The single CPE provided (cpe:2.3:a:google:chrome) is generic and does not distinguish the Android build, but the description scopes impact specifically to Chrome on Android.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack is executed by a co-installed local app (AV:L) with no prior privileges or victim interaction (PR:N/UI:N); origin bypass primarily exposes cross-origin data (C:H) with limited integrity and no availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
2DescriptionCVE.org
Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android versions before 152.0.7977.65 contain a CRITICAL-rated web origin policy bypass in the CustomTabs component that could allow a co-installed malicious app to access restricted content. However, real-world exploitation risk is minimal: EPSS stands at 0.1%, no public exploit exists, and the attack requires an attacker-controlled app already present on the device. A vendor patch is available and should be deployed as part of routine update cycles.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB