Description

Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-08-25T21:18:01.373Z",
  "pubdate": "2026-08-25T21:18:01.373Z",
  "executiveSummary": "This vulnerability is an information disclosure flaw identified within the Sharing component of Google Chrome on Android. The issue resides in how the application manages data transmission or interface representation when interacting with other installed applications.\nThe vulnerability allows a local, co-installed malicious application to intercept or access sensitive data being processed by the Sharing feature. Exploitation is predicated on the successful execution of a social engineering campaign, wherein the user is coerced into initiating a share operation that the malicious application can observe or manipulate.\nImpact is categorized as Low by the Chromium security team; however, the successful exploitation leads to unauthorized sensitive information exposure. Affected versions include all releases of Google Chrome for Android prior to 152.0.7977.65. The risk is localized to the device environment, requiring the presence of a malicious application alongside the browser. Mitigation requires updating the browser to the patched version to resolve the underlying handling logic flaw.",
  "technicalDetails": "The vulnerability originates from insufficient validation or improper sanitization of data passing through the Sharing intent mechanism within Google Chrome for Android. When a user triggers the sharing interface, the browser prepares data—potentially containing sensitive context or metadata—to be transmitted via Android Intents to other registered applications.\nThe root cause is an unintended exposure of data during this inter-app communication process. A malicious application, residing on the same device, can register intent filters or leverage existing Android IPC (Inter-Process Communication) mechanisms to monitor or intercept the data packets intended for legitimate sharing targets. Because the sharing mechanism did not properly restrict the scope of data access or ensure the integrity of the destination application, the co-installed malicious app can access sensitive information that was not intended for its scope of operation.\nThe attack flow follows a specific sequence: First, an attacker must deploy a malicious application on the target Android device. Second, the attacker uses social engineering techniques to trick the user into using the 'Sharing' feature in Chrome while the malicious application is running in the background or positioned to intercept the intent. Third, the browser initiates the share action, creating an Intent containing the sensitive data. Fourth, the malicious app intercepts this Intent, capturing the payload, effectively bypassing the expected data privacy boundary. Finally, the malicious application exfiltrates this intercepted data to an attacker-controlled server.\nThe vulnerability exists specifically within the Sharing component of the Chromium browser codebase as implemented on the Android platform. It affects all versions prior to 152.0.7977.65. Exploitation does not require elevated privileges (root access), but it does require that the attacker's app is already installed on the victim's device and that the user is successfully socially engineered into performing the target action. The threat model is strictly local, as it relies on device-side process communication rather than remote network injection."
}