Description

Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Low)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-25T21:18:10.490Z",
  "pubdate": "2026-08-25T21:18:10.490Z",
  "executiveSummary": "This vulnerability involves an incorrect authorization implementation within the CustomTabs component of Google Chrome on Android. The flaw permits a local attacker to circumvent the web origin policy, which is a critical security boundary designed to prevent unauthorized cross-origin data access.\nThe vulnerability affects versions of Google Chrome on Android prior to 152.0.7977.65. Successful exploitation allows a co-installed malicious application to perform unauthorized actions or gain access to information that should be protected by the same-origin policy.\nThe risk implication is categorized as Low by the Chromium security team; however, the ability to bypass origin-based security checks creates a vector for data exfiltration or session interference. Exploitation requires the presence of a malicious app on the target device, meaning it is a local attack that does not require network-level access, but rather relies on the inter-application communication environment of the Android operating system.\nOrganizations and users should prioritize upgrading to the patched version of the browser to remediate the authorization logic flaw and restore the integrity of the browser's security boundaries.",
  "technicalDetails": "The root cause of this vulnerability lies in an insufficient authorization check within the CustomTabs integration in Google Chrome on Android. CustomTabs allows third-party applications to open web content within the browser context while maintaining the browser's UI/UX and engine capabilities. By improperly validating the origin of requests or intent initiators, the implementation fails to strictly enforce the web origin policy.\nThe vulnerability facilitates a bypass of the web origin policy, which is a fundamental security mechanism used to prevent scripts on one origin from accessing data on another. In the context of this flaw, a co-installed application can leverage the misconfiguration to interact with the CustomTabs session in a manner that exceeds its intended privilege level.\nThe attack flow begins with an attacker deploying a malicious application onto the same Android device as the target Google Chrome instance. When a user interacts with this malicious application, it initiates a series of crafted Intents or inter-process communication (IPC) calls to the Chrome CustomTabs component. Due to the lack of proper authorization validation, the CustomTabs infrastructure fails to distinguish between the legitimate, expected caller and the malicious application.\nBecause the authorization check is flawed, the malicious application is able to trick the CustomTabs component into executing operations or accessing resources that would normally be blocked by the browser's same-origin security model. This could potentially allow the malicious application to read content, perform actions on behalf of the user within the context of a trusted web origin, or otherwise manipulate the browser's internal session state.\nThis is a local privilege escalation/bypass vulnerability that does not require network exposure, as the attack is orchestrated entirely through the Android IPC and intent-handling mechanisms. The vulnerability is strictly confined to local exploitation on the host device where both the malicious application and the vulnerable browser are installed.\nThe post-exploitation impact includes the potential for cross-origin information leakage or the execution of unauthorized web requests. While the severity is low, the ability to subvert origin protections undermines the browser's sandbox model, potentially allowing an attacker to breach the isolation between the malicious app and the web content handled by CustomTabs."
}