Description
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
Published: 2026-08-25
Score: 5.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information exposure to local attacker
Action: Patch
AI Analysis

Impact

Information can leak from the Sharing feature in Google Chrome on Android up to version 152.0.7977.65. A user can be tricked into installing an additional app that gains local access, allowing that app to read sensitive data from the browser. The weakness is an information‑leak flaw described by CWE-200 and the Chromium security team rates the vulnerability as low severity.

Affected Systems

The vulnerability affects Google Chrome for Android versions before 152.0.7977.65. Only devices running the affected releases of Chrome on Android are in scope. Upgrading to the fixed release removes the flaw.

Risk and Exploitability

The risk of exploitation is limited to local attackers who can convince a user to install a co‑installed app. Because the EPSS score is < 1% and the vulnerability has a CVSS score of 5.1, there is currently low evidence of active exploitation. The flaw is developer‑controlled and requires social engineering, so the exploitability is moderate but constrained by the need for user interaction.

Generated by OpenCVE AI on August 26, 2026 at 21:59 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to Google Chrome Android 152.0.7977.65 or later on all devices
  • Avoid installing untrusted apps that may be promoted via the Sharing interface
  • In environments where updates are delayed, use mobile‑device‑management controls to restrict app installations and monitor for anomalous sharing activity

Generated by OpenCVE AI on August 26, 2026 at 21:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Wed, 26 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Local Information Leak via Co-Installed App in Chrome Android Sharing

Wed, 26 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 26 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 25 Aug 2026 23:30:00 +0000

Type Values Removed Values Added
Title Local Information Leak via Co-Installed App in Chrome Android Sharing

Tue, 25 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
Weaknesses CWE-200
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-26T18:37:53.752Z

Reserved: 2026-08-25T06:08:22.549Z

Link: CVE-2026-79055

cve-icon Vulnrichment

Updated: 2026-08-26T18:18:42.920Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:01.373

Modified: 2026-08-26T20:10:02.267

Link: CVE-2026-79055

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T22:00:04Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor