Description
Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
Published: 2026-09-09
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Data Exposure
Action: Patch Now
AI Analysis

Impact

The vulnerability is a missing authorization check in Chrome's Trusted Web Activities (TWA) implementation on Android devices. It allows a local attacker who can co‑install a malicious app to access TWA content and retrieve sensitive information that would normally be protected. This flaw is an information disclosure weakness identified as CWE-862.

Affected Systems

The issue affects Google Chrome for Android versions prior to 153.0.8010.36. Any device running an impacted Chrome build and that installs an app able to register a Trusted Web Activity is vulnerable.

Risk and Exploitability

Exploitation requires local privilege; an attacker must have the ability to install or modify an application on the target device. The vulnerability carries a Chromium security severity of high, with a CVSS score of 5.5 and an EPSS score of < 1%, and it is not listed in CISA's KEV catalog, indicating that widespread exploitation has not yet been observed. Nonetheless, devices with outdated Chrome and the presence of untrusted apps represent a significant risk for sensitive data exposure.

Generated by OpenCVE AI on September 10, 2026 at 15:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 153.0.8010.36 or later.
  • Disallow the use of Trusted Web Activities on the device, for example by disabling the related Chrome policy or uninstalling the co‑installed app.
  • Prevent installation of untrusted apps that request Trusted Web Activities through device management or user education.

Generated by OpenCVE AI on September 10, 2026 at 15:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4790-1 chromium security update
Debian DSA Debian DSA DSA-6506-1 chromium security update
History

Thu, 10 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title Chrome Trusted Web Activities Authorization Flaw Exposes Sensitive Information

Thu, 10 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google android
Google chrome
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google
Google android
Google chrome
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Wed, 09 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Title Chrome Trusted Web Activities Authorization Flaw Exposes Sensitive Information

Wed, 09 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
Description Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
Weaknesses CWE-862
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-10T15:27:50.058Z

Reserved: 2026-09-08T22:40:25.212Z

Link: CVE-2026-87552

cve-icon Vulnrichment

Updated: 2026-09-10T15:27:46.368Z

cve-icon NVD

Status : Modified

Published: 2026-09-09T01:17:12.793

Modified: 2026-09-10T16:18:05.883

Link: CVE-2026-87552

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T01:30:13Z

Weaknesses