Description
Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Web origin policy bypass via crafted HTML page
Action: Apply Chrome update
AI Analysis

Impact

Race condition in Chrome permissions handling on Android devices allows an attacker to craft a web page that bypasses the browser’s web origin policy when the user opens it. This flaw can lead to unauthorized cross‑origin access to a web page’s resources or manipulation of page content, effectively exposing confidential data or enabling further attacks.

Affected Systems

Google Chrome for Android, including all versions released before 152.0.7977.65.

Risk and Exploitability

The CVSS score of 4.3 indicates a medium severity. The EPSS score of less than 1% suggests that exploitation is expected to be rare. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed. An attacker would need to use social engineering to convince a user to open a specifically crafted HTML page. Given the low EPSS, the overall risk of real‑world exploitation is considered low.

Generated by OpenCVE AI on August 28, 2026 at 19:08 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome on Android to version 152.0.7977.65 or later.
  • Restrict the affected device’s access to potentially malicious web content or use a reputable web filter.
  • Enable device policies that limit social engineering exposure, such as blocking unknown app installations and enforcing safe browsing guidelines.

Generated by OpenCVE AI on August 28, 2026 at 19:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Fri, 28 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Title Race Condition in Permissions Enables Web Origin Policy Bypass in Chrome Android

Fri, 28 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Thu, 27 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Race Condition in Permissions Enables Web Origin Policy Bypass in Chrome Android

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-367
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-27T20:37:07.170Z

Reserved: 2026-08-25T06:08:13.355Z

Link: CVE-2026-79046

cve-icon Vulnrichment

Updated: 2026-08-27T20:32:00.571Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:00.360

Modified: 2026-08-28T14:38:29.300

Link: CVE-2026-79046

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T19:15:05Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition