Description

Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-25T21:18:00.133Z",
  "pubdate": "2026-08-25T21:18:00.133Z",
  "executiveSummary": "A security vulnerability categorized as a missing authorization flaw exists within the WebAppInstalls component of Google Chrome on Android.\nThe vulnerability permits a remote attacker who has already achieved compromise of the renderer process to access and extract sensitive information.\nBy leveraging a specially crafted HTML page, an adversary can bypass existing security boundaries to perform unauthorized read operations.\nThe vulnerability is rated as Medium severity by the Chromium project.\nThe scope of impact is confined to the context of the compromised renderer process, though it effectively breaks the isolation between the renderer and protected WebAppInstalls data.\nSuccessful exploitation requires the attacker to first gain code execution within the renderer process, typically through a secondary exploit targeting the browser's JavaScript engine or other renderer-side components.\nThis vulnerability highlights a failure in the browser's security architecture to properly enforce authorization checks when the renderer process attempts to access sensitive WebAppInstalls metadata or state.",
  "technicalDetails": "The vulnerability resides within the WebAppInstalls module, which is responsible for managing the installation status, configuration, and lifecycle of Progressive Web Apps (PWAs) within the Google Chrome environment on the Android platform.\nThe root cause of this security flaw is improper authorization validation when the browser's renderer process communicates with the browser process (or internal services) to request data related to web application installations.\nIn the Chromium multi-process architecture, the renderer process is intended to operate in a sandbox with restricted access to sensitive system or application-level data. The browser process acts as the trusted entity that manages elevated privileges and mediates access to sensitive resources.\nUnder normal operating conditions, the browser process must verify that any request originating from the renderer for WebAppInstalls data is authorized by the current context, origin, and security policy. In this vulnerable state, these integrity checks are absent or insufficiently implemented for certain WebAppInstalls interfaces.\nThe attack vector necessitates that an attacker first successfully execute arbitrary code within the renderer process, likely utilizing a separate vulnerability such as a Use-After-Free (UAF) or Out-of-Bounds (OOB) access in the V8 JavaScript engine or the Blink rendering engine.\nOnce the renderer process is compromised, the attacker can execute JavaScript code that sends crafted Inter-Process Communication (IPC) messages or API calls to the vulnerable WebAppInstalls interface.\nBecause the interface lacks proper authorization checks, it treats the request as a legitimate call rather than a cross-origin or unauthorized request. The interface subsequently returns sensitive metadata, configuration details, or internal state information associated with installed web applications to the compromised renderer process.\nThe attacker can then extract this sensitive information by parsing the response within the malicious HTML document or injected script.\nThis vulnerability specifically affects Google Chrome on Android versions prior to 152.0.7977.65. The lack of authorization effectively undermines the browser's sandbox isolation, allowing for privilege escalation within the context of the application's data management logic.\nThe post-exploitation impact includes the potential leakage of user-installed app configurations, potentially revealing information about the user's workflow, installed services, or other private data that should have remained restricted to the browser process or authorized contexts."
}