Description

Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-25T21:18:01.593Z",
  "pubdate": "2026-08-25T21:18:01.593Z",
  "executiveSummary": "A race condition vulnerability exists within the Start component of Google Chrome on Android, affecting versions prior to 152.0.7977.65. This security flaw enables a local attacker to potentially bypass the application sandbox and execute arbitrary code.\nThe vulnerability is categorized as a medium-severity issue, requiring a combination of social engineering tactics and the presence of a co-installed malicious application on the target device.\nBy manipulating the timing of process execution or state transitions within the Start component, an attacker can influence the application's behavior during a race window. Successful exploitation allows for unauthorized code execution outside the security boundaries of the browser's sandbox.\nThe risk is primarily localized to the Android ecosystem, where malicious applications can interact with other installed software. Because this attack necessitates user interaction via social engineering, the primary defense involves software updates and caution regarding third-party application installations. There is no requirement for network-level access, as the exploit is performed locally on the handset.",
  "technicalDetails": "The root cause of this vulnerability is a race condition within the 'Start' component of the Google Chrome for Android browser. Race conditions occur when a system or component attempts to perform two or more operations concurrently, but the outcome depends on the uncontrollable order in which these operations are completed. In this context, the browser fails to properly synchronize the state transitions or object access patterns within the Start logic, creating a temporal window where an attacker can intervene.\nExploitation requires the presence of a secondary, co-installed application on the victim's device. The attacker leverages social engineering—such as deceptive prompts or UI overlays—to coerce the user into triggering a specific sequence of events that align with the vulnerable code path in the Start component. Because the Start component may handle sensitive initialization tasks or intent processing, a race condition here can lead to a 'Time-of-Check to Time-of-Use' (TOCTOU) flaw or an incorrect state transition.\nThe attack flow proceeds as follows: First, the attacker ensures their malicious application is installed on the target Android device. Second, the attacker uses social engineering to induce the user into interacting with Chrome in a manner that triggers the vulnerable Start sequence. During this execution window, the attacker's malicious application interacts with the Chrome process, attempting to race against the internal browser logic to replace, modify, or manipulate object references before they are finalized or validated by the browser.\nBy winning this race, the attacker forces the Start component to act upon malicious inputs or state configurations. This bypasses the browser's sandbox—a fundamental security boundary designed to restrict the impact of browser vulnerabilities—allowing the execution of arbitrary code with the privileges of the Chrome application. The ability to break out of the sandbox signifies a significant failure of the browser's isolation architecture, potentially leading to unauthorized data access, arbitrary command execution, or the installation of further payloads depending on the permissions granted to the Chrome process on the Android system. This vulnerability affects all Google Chrome for Android versions prior to 152.0.7977.65."
}