Description
Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Bypass Web Origin Policy
Action: Patch
AI Analysis

Impact

An incomplete cleanup in CustomTabs in Google Chrome on Android prior to version 155.0.8059.39 permits a remote attacker to bypass web origin policy through a crafted HTML page. The flaw was rated high severity by Chromium security.

Affected Systems

Google Chrome for Android devices running versions older than 155.0.8059.39 are affected.

Risk and Exploitability

The vulnerability can be triggered remotely via a specially crafted web page accessed through CustomTabs. The CVSS score of 5.4 indicates moderate severity, but the EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting a low probability of exploitation. Attackers could exploit the flaw to execute actions across origins, potentially compromising user data or performing malicious tasks within the browser context.

Generated by OpenCVE AI on October 17, 2026 at 08:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome on all Android devices to version 155.0.8059.39 or later.
  • If an app uses CustomTabs, review the implementation to ensure it handles untrusted content safely or disable CustomTabs for that app.
  • If an immediate update is not possible, configure device or application policies to restrict or block CustomTabs usage in untrusted applications.

Generated by OpenCVE AI on October 17, 2026 at 08:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Wed, 14 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 14 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome Android CustomTabs Web Origin Policy Bypass chromium-browser: Incomplete cleanup in CustomTabs
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 07 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 07 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Title Chrome Android CustomTabs Web Origin Policy Bypass

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incomplete cleanup in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-459
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-14T12:37:10.446Z

Reserved: 2026-10-06T16:36:38.707Z

Link: CVE-2026-106366

cve-icon Vulnrichment

Updated: 2026-10-14T12:37:03.395Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:05.620

Modified: 2026-10-14T18:39:36.233

Link: CVE-2026-106366

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:07Z

Links: CVE-2026-106366 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T08:30:05Z

Weaknesses