Description
Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
Published: 2026-09-29
Score: 4.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local Privilege Escalation
Action: Apply Patch
AI Analysis

Impact

An incorrect authorization check in Google Chrome for Android allowed a local attacker to bypass system access restrictions and reach a privileged page through a co‑installed application. The flaw lets the attacker gain elevated access within the Chrome process, potentially exposing sensitive data or modifying application state. This is an access control bypass identified as CWE-863.

Affected Systems

The vulnerability affects Chrome for Android versions prior to 154.0.8037.57 on any Android device running that Chrome release.

Risk and Exploitability

The flaw requires a local attacker who can install or otherwise run a co‑installed app, limiting broad exploitation potential. Chromium classifies the severity as Medium (CVSS 4.4). EPSS score is 0.00136, indicating a very low probability of exploitation. The issue is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on October 1, 2026 at 00:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome to version 154.0.8037.57 or later on all Android devices.
  • Remove or uninstall any recently installed applications that were installed together with Chrome before the upgrade.
  • Disable automatic installation of apps from unknown or untrusted sources to reduce the chance of a local attacker deploying a malicious co‑installed app.

Generated by OpenCVE AI on October 1, 2026 at 00:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6513-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Incorrect authorization in Mobile
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 01 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Thu, 01 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Title Chrome for Android Local Privilege Escalation via Co‑Installed App

Wed, 30 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 30 Sep 2026 00:00:00 +0000

Type Values Removed Values Added
Title Chrome for Android Local Privilege Escalation via Co‑Installed App

Tue, 29 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 29 Sep 2026 17:45:00 +0000

Type Values Removed Values Added
Description Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. (Chromium security severity: Medium)
Weaknesses CWE-863
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-09-30T20:11:06.952Z

Reserved: 2026-09-22T05:10:42.235Z

Link: CVE-2026-95358

cve-icon Vulnrichment

Updated: 2026-09-30T19:57:36.991Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-29T18:17:28.930

Modified: 2026-10-01T17:29:03.767

Link: CVE-2026-95358

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-29T17:31:55Z

Links: CVE-2026-95358 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T00:15:14Z

Weaknesses