Description

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.1",
  "pubDate": "2026-08-25T21:18:04.200Z",
  "pubdate": "2026-08-25T21:18:04.200Z",
  "executiveSummary": "A missing authorization vulnerability exists within the CustomTabs component of Google Chrome for Android prior to version 152.0.7977.65. This flaw permits a malicious co-installed application on the same device to bypass security boundaries and access sensitive data handled by the CustomTabs interface. The vulnerability is classified as Medium severity, reflecting the requirement for local access or the presence of a malicious third-party application on the victim's device. By exploiting this authorization failure, an attacker can perform unauthorized data exfiltration, compromising user privacy and potentially leaking session-specific information or browser-contextual data. The attack vector is localized, necessitating that the attacker successfully installs an application on the target system to interact with the vulnerable CustomTabs intent-handling mechanism. Organizations and users should ensure that Google Chrome is updated to the specified patched version or later to mitigate the risk of unauthorized data exposure occurring through cross-application communication channels.",
  "technicalDetails": "The vulnerability originates from an improper access control implementation within the CustomTabs integration framework in Google Chrome for Android. CustomTabs allows third-party applications to open web content within the browser context, providing a seamless user experience while leveraging the browser's capabilities, such as saved cookies, autofill data, and existing authentication sessions. The underlying security mechanism relies on strict authorization checks to ensure that only legitimate or authorized applications can communicate with the CustomTabs service and request sensitive information or perform privileged actions.\nThe root cause is a failure in the authorization logic, specifically involving the validation of incoming intents or service binding requests from external applications. Because the browser fails to verify the calling application's identity or authorization status correctly, it inadvertently permits untrusted co-installed applications to interact with the CustomTabs interface. This lack of rigorous boundary enforcement allows a malicious package to leverage established IPC (Inter-Process Communication) mechanisms to query the browser process.\nThe exploitation flow proceeds as follows: First, a malicious application is installed on the Android device. This application initiates a connection to the CustomTabs service exposed by Google Chrome. Due to the missing authorization check, the browser process accepts this connection without verifying whether the requesting application possesses the necessary permissions to access the desired context. Second, the attacker's application sends crafted requests via the interface, which the browser executes or responds to as if they were coming from a trusted or authorized context. This allows the attacker to intercept or request sensitive information that is implicitly associated with the CustomTabs session. The attack does not require elevated system privileges beyond those of a standard user-installed application, nor does it require network exposure, as the entire exploitation vector is contained within the local device environment. The post-exploitation impact includes the potential for unauthorized exfiltration of sensitive information, such as authentication tokens, session data, or other information accessible through the CustomTabs context, thereby bypassing the intended security isolation provided by the Android sandbox and browser security architecture."
}