CVE-2026-79055

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 5.1 Medium EPSS < 1% KEV · Not listed
Description
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

Information can leak from the Sharing feature in Google Chrome on Android up to version 152.0.7977.65. A user can be tricked into installing an additional app that gains local access, allowing that app to read sensitive data from the browser. The weakness is an information‑leak flaw described by CWE-200 and the Chromium security team rates the vulnerability as low severity.

Affected Systems

The vulnerability affects Google Chrome for Android versions before 152.0.7977.65. Only devices running the affected releases of Chrome on Android are in scope. Upgrading to the fixed release removes the flaw.

Risk and Exploitability

The risk of exploitation is limited to local attackers who can convince a user to install a co‑installed app. Because the EPSS score is < 1% and the vulnerability has a CVSS score of 5.1, there is currently low evidence of active exploitation. The flaw is developer‑controlled and requires social engineering, so the exploitability is moderate but constrained by the need for user interaction.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Google Chrome Android 152.0.7977.65 or later on all devices
  • Avoid installing untrusted apps that may be promoted via the Sharing interface
  • In environments where updates are delayed, use mobile‑device‑management controls to restrict app installations and monitor for anomalous sharing activity

Generated by OpenCVE AI on August 26, 2026 at 21:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Title Local Information Leak via Co-Installed App in Chrome Android Sharing
Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Local Information Leak via Co-Installed App in Chrome Android Sharing
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
Weaknesses CWE-200
References
Earlier changes (1)
Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Aug 26, 2026, 6:37 PM
Reserved
Aug 25, 2026, 6:08 AM

View source JSON

Updated
Aug 26, 2026, 6:18 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 26, 2026, 8:10 PM

View source JSON

No data.

Updated
Aug 26, 2026, 10:00 PM

JSON