Description

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-25T21:18:22.747Z",
  "pubdate": "2026-08-25T21:18:22.747Z",
  "executiveSummary": "This vulnerability involves a missing authorization flaw within the CustomTabs component of Google Chrome on Android. The defect allows a local attacker to bypass existing security boundaries, potentially facilitating arbitrary code execution outside the application's sandbox. The vulnerability affects versions of Google Chrome for Android prior to 152.0.7977.65. Exploitation requires the presence of a co-installed malicious application on the target device, which leverages the flaw to interact with the vulnerable CustomTabs implementation. Given the ability to escape the sandbox, this issue poses a significant risk to the integrity and confidentiality of the device's user data and system state. The Chromium project has categorized the severity of this vulnerability as Medium, reflecting the local attack vector and the requirement for a secondary application to be installed on the victim's device to initiate the exploit chain.",
  "technicalDetails": "The vulnerability resides within the CustomTabs component, an Android-specific feature of Google Chrome that allows applications to launch web content within a customized browser tab. The root cause is a failure to properly implement authorization checks during the interaction between the host application and the CustomTabs service. This oversight creates an interface where an unauthorized, co-installed application can send intent-based messages or perform inter-process communication (IPC) that the CustomTabs service fails to validate sufficiently.\nThe attack flow begins when a malicious local application crafts and transmits a specifically structured intent to the CustomTabs service. Because the vulnerable component does not enforce mandatory authorization tokens or caller verification, it incorrectly assumes the source of the communication is authorized to perform privileged operations or access protected internal resources. By exploiting this lack of validation, the attacker can influence the execution flow of the CustomTabs process. If the attacker succeeds in manipulating the input parameters or triggering unintended functionality within the browser context, they can transition from the restricted environment of the browser's CustomTabs instance into the broader Android system context.\nThis transition constitutes a sandbox escape, allowing the execution of arbitrary code with the permissions granted to the Chrome process or potentially leveraging higher-privilege system APIs if the component interaction exposes such interfaces. The exploit does not require remote network access; it is strictly a local attack vector relying on the capability of a malicious app to communicate with the browser's process. The vulnerability persists in all instances of Google Chrome on Android prior to 152.0.7977.65. The impact is significant as it breaks the fundamental isolation provided by the Android process sandbox, enabling an attacker to potentially compromise the application data or execute actions on behalf of the user without explicit authorization. The absence of robust access control lists (ACLs) or signature-based permission verification for these IPC channels is the critical technical failure enabling this exploitation methodology."
}