CVE-2026-79089

View on CVE.org
Published Aug 25, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

Analysis

AI-generated

Technical impact

A race condition exists in the Transactions Platform of Google Chrome on Android before version 152.0.7977.65. The flaw can be triggered by a maliciously crafted HTML page, allowing a remote attacker, with social engineering, to bypass system access restrictions. The weakness is a classic race condition and is identified as CWE‑367.

Affected Systems

Google Chrome for Android users running any version prior to 152.0.7977.65 are affected. The issue does not apply to Chrome versions newer than the stated cutoff or to non‑Android variants.

Risk and Exploitability

Chromium labels the vulnerability with low severity, and the CVSS score is 5.3. The EPSS score indicates a probability of exploitation less than 1 percent, and the issue is not listed in the CISA KEV catalog. The attack requires a user to open a specifically crafted HTML page, so it relies on social engineering and user interaction. Given the low severity rating and limited exploitation probability, the overall risk is considered moderate but still actionable.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome to version 152.0.7977.65 or later.
  • Avoid opening unknown or suspicious HTML pages or links in Chrome until the patch is applied.
  • Keep the Android operating system and all applications up to date to reduce the overall attack surface.

Generated by OpenCVE AI on August 28, 2026 at 23:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android
Type Values Removed Values Added
Title Race Condition in Chrome Transactions Platform Allows Access Restriction Bypass on Android
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Title Race Condition in Chrome Transactions Platform Allows Access Restriction Bypass on Android
Type Values Removed Values Added
Description Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-367
References
Earlier changes (2)
Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Sep 17, 2026, 6:55 PM
Reserved
Aug 25, 2026, 6:09 AM

View source JSON

Updated
Aug 28, 2026, 6:11 PM

JSON

Status
Analyzed
Published
Aug 25, 2026, 9:18 PM
Modified
Aug 31, 2026, 2:58 PM

View source JSON

No data.

Updated
Aug 28, 2026, 11:15 PM

JSON