Description

Information leak in Intents in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-25T21:18:07.540Z",
  "pubdate": "2026-08-25T21:18:07.540Z",
  "executiveSummary": "This vulnerability involves an information disclosure flaw within the Android-specific Intent handling mechanism in Google Chrome.\nThe issue allows a remote attacker to exfiltrate sensitive data by leveraging a maliciously crafted HTML page that interacts with the browser's Intent dispatching architecture.\nAffected versions include Google Chrome on Android prior to 152.0.7977.65.\nThe vulnerability is categorized as a low-severity security issue; however, it permits unauthorized access to sensitive information without requiring elevated user privileges or local system access.\nExploitation is conducted remotely, where an attacker lures a user to a compromised or weaponized web page to trigger the leakage through improper Intent validation.\nThe impact is limited to the scope of data accessible via the exposed Intent surface, which may include browser-internal state or user-associated context.",
  "technicalDetails": "The vulnerability originates from an improper validation or security boundary enforcement within the Intent processing pipeline in the Android implementation of Chromium.\nIn Android, Intents serve as the primary messaging object for cross-component communication. Chrome utilizes these to interface with the Android operating system, facilitate inter-app navigation, and execute specific browser tasks.\nThe flaw exists when the browser incorrectly handles a specifically crafted Intent triggered from within an HTML context. An attacker can instantiate a web page containing a malicious payload that invokes a targeted Intent, circumventing the intended security constraints designed to prevent unauthorized cross-component communication.\nThe exploitation flow proceeds as follows: First, the attacker hosts a malicious HTML page on a remote server. Second, the victim navigates to this page using an affected version of Google Chrome on Android. Third, the page executes JavaScript designed to trigger the vulnerable Intent interface. Fourth, the browser, failing to sufficiently sanitize or verify the origin and legitimacy of the Intent request, executes the call.\nThis results in the leakage of sensitive information, which the attacker can then exfiltrate back to their server. Because the vulnerability lies within the way Chrome manages the data-passing interface between the web engine (Blink) and the Android framework, it does not require authentication or physical interaction with the device.\nThe root cause is likely an insecure handling of parameters passed during Intent invocation, allowing for an information disclosure side-channel. This interaction bypasses standard browser sandbox policies that should restrict the types of data accessible to arbitrary web content. The exposure is persistent across any session until the patch is applied, as the browser fails to correctly restrict the scope of information returned by the OS-level interaction triggered by the intent."
}