CVE-2026-113099 describes a Confused Deputy vulnerability in the Omnibox of Google Chrome for Android versions earlier than 156.0.8078.47. The flaw enables a local attacker, through social engineering and a co‑installed app, to obtain sensitive information. This is a classic Confused Deputy scenario (CWE‑441) that does not require arbitrary code execution; instead, it lets a malicious or compromised app that the user installs access privileged data. The vulnerability is limited to the omnibox component and does not involve external network communication.

Google Chrome for Android users running any version earlier than 156.0.8078.47 are affected. The issue is confined to the omnibox component and may be triggered through a co‑installed app that exploits social engineering to gain user interaction.

The CVSS score of 8.8 indicates a high‑severity vulnerability, yet the EPSS score is <1%, so publicly known exploitation is limited. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to co‑install a malicious app and rely on user interaction with the omnibox, which constitutes a local attack vector and requires social engineering. The overall risk remains high due to the potential for sensitive data disclosure, but the likelihood of exploitation remains low.