CVE-2026-78936

Executive Summary

CVE-2026-78936 is a medium-severity (Chromium security severity: Medium) information-disclosure vulnerability affecting Google Chrome on Android prior to version 152.0.7977.65. The flaw resides in the CustomTabs component, where an observable discrepancy (classified under CWE-203: Observable Discrepancy) enables a local attacker — via a co-installed application — to obtain cross-origin data from a Chrome CustomTab session. The attack requires local access to the device and the presence of a malicious co-installed app, limiting the remotely exposed attack surface but expanding the local mobile threat landscape. No CVSS score is available (N/A), and the exploitability has not been independently confirmed. Patch confidence is rated 2/4 (CLAIMED) with the sole source being NVD; no vendor advisory has been directly observed by us.

Technical Analysis

The NVD description identifies the vulnerability class as an "Observable discrepancy" (CWE-203). This CWE classification describes a scenario where the behavior of a system differs in an observable way depending on the state of internal data, which can be used by an attacker to infer confidential information. In the context of CustomTabs on Android, this translates to a side-channel or timing-based oracle that leaks information across an origin boundary.

CustomTabs is an Android component that allows third-party applications to launch a customized Chrome rendering environment without leaving the host application's context entirely. A co-installed malicious application can observe the state and behavior of a CustomTab session launched by a legitimate (victim) application. Because CustomTabs runs in a separate process but shares the Chrome rendering engine, the malicious app can probe or monitor discrepancies (e.g., timing, rendering outcomes, or process states) that differ based on the content of the cross-origin page being loaded.

The attack mechanism does not involve a traditional memory-corruption, injection, or logic bypass. Instead, it leverages an information side-channel: the malicious local app determines the presence or value of cross-origin data by observing how the CustomTab behavior changes (discrepancy) when that data is present versus absent. This is a form of cross-origin data exfiltration via a local oracle. Specific implementation details (function names, IPC endpoints, or exact observable parameters) are not available from the NVD description, and insufficient technical detail is available to enumerate them without speculation.

Attack surface: Android devices with Chrome (or WebView-backed Chrome components) prior to 152.0.7977.65 installed, where a second app can be sideloaded or installed from an app store. The attack does not require network access to the victim; it requires process or activity-level observation on the device.

Root cause: The "observable discrepancy" implies that Chrome's CustomTabs implementation exposes distinguishable state transitions (e.g., rendering completion timing, color scheme changes, or resource load ordering) that correlate with the presence of specific cross-origin data. An attacker can measure these discrepancies programmatically to infer data they should not have access to. Without vendor source code or a detailed CNA description, the precise internal mechanism remains unknown; this report describes the vulnerability at the class level as required by the available data.

Exploitation Scenarios

Step 1: Reconnaissance / Target identification. The attacker distributes a benign-looking Android application (malicious co-installed app). The victim installs the malicious app alongside a legitimate app that uses Chrome CustomTabs to open URLs (e.g., banking, email, or social media apps). The malicious app enumerates running processes and activities via Android's accessibility services or ActivityManager APIs to identify when a CustomTab session begins.

Step 2: Triggering the flaw. When the victim app launches a CustomTab to a cross-origin URL (e.g., a payment page containing tokens or personal data), the malicious app observes the CustomTab process state. The attacker does not need to interact with the victim; they passively monitor the behavior of the Chrome process hosting the CustomTab. The "observable discrepancy" is activated when the malicious app measures differences in Chrome's observable behavior based on whether certain data (cookies, headers, DOM content) is present in the cross-origin page.

Step 3: Payload / execution method (vulnerability-class level). The execution method is an oracle-based side-channel: the malicious app repeatedly probes or observes the CustomTab's response times, memory usage patterns, or rendering milestones. By comparing these observations across different page loads (or by triggering re-loads), the attacker infers the presence or absence of specific cross-origin data. No code injection or memory corruption is required; the attack is purely observational. No specific API names or endpoints are available from the NVD description; exploitation is inferred from the vulnerability class.

Step 4: Post-exploitation impact. The attacker exfiltrates cross-origin data that should be isolated by Chrome's origin model. This could include session tokens, email addresses, personal identifiers, or any data rendered within the cross-origin CustomTab content. The data is then transmitted by the malicious app to the attacker's C2 server via standard HTTP/S exfiltration. The confidentiality impact is high for the specific data exposed, although the attack requires local presence and the co-installation prerequisite limits the scale.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-203) and the NVD description. The lack of a CVSS score and EPSS score (not yet scored by FIRST.org) reflects the incomplete public understanding of the exploitability.

Impact Assessment

Business impact: For enterprises with mobile workforces using Android devices, this vulnerability allows a locally installed malicious app to siphon sensitive cross-origin data from trusted applications that leverage Chrome CustomTabs. This can result in credential theft, session hijacking, or exfiltration of personally identifiable information (PII), leading to regulatory consequences (GDPR, CCPA) and reputational damage.

Affected systems: All Android devices running Google Chrome (or Chrome-based components) prior to version 152.0.7977.65. The attack requires a co-installed malicious application, so the affected population is limited to devices where users install third-party apps outside of managed, strictly-controlled environments.

Blast radius: Medium. The local requirement significantly narrows the attack surface compared to network-reachable vulnerabilities. However, mobile malware campaigns (e.g., banking trojans) commonly operate under these exact conditions (co-installed apps observing legitimate apps), making this a viable vector for targeted mobile threat actors. The lack of CVSS data (N/A) prevents precise severity ranking; Chromium rates it as Medium. The confidentiality impact is high — cross-origin data exfiltration undermines the browser's core security boundary — but integrity and availability are unaffected.

Detection Guidance

Sigma Rule

Detection strategy: Monitor process creation on Android devices (via MDM/EMM telemetry) for anomalous behavior where a third-party app spawns or observes Chrome processes in a loop, suggesting oracle probing.

title: Android CustomTabs Cross-Origin Data Exfiltration - Process Observation Loop
status: experimental
description: Detects a local Android app repeatedly observing Chrome process activity, indicative of CVE-2026-78936 side-channel probing.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-78936
logsource:
    product: android
    service: process_creation
detection:
    selection:
        EventID: 1  # Process creation
        Image|endswith: 'com.google.android.chrome'
        ParentImage|endswith:
            - 'com.suspicious.app'
            - 'com.unknown.vendor'
    condition: selection and (process.repeat_observation_count > 50)
fields:
    - ParentImage
    - Image
    - CommandLine
falsepositives:
    - Legitimate apps using analytics SDKs that monitor other apps
level: high

YARA Rule

Detection strategy: Match on strings/log artifacts that may be produced by malware attempting to observe CustomTab state changes or identify Chrome activity from a local context.

rule CVE_2026_78936_Android_CustomTabs_Probe {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious APK strings indicating CustomTabs observation for cross-origin data exfiltration"
        reference = "CVE-2026-78936"
        date = "2026-01-01"
    strings:
        $s1 = "customtabs" ascii wide nocase
        $s2 = "onNavigationEvent" ascii wide nocase   // Generic CustomTabs callback (not vendor-specific)
        $s3 = "androidx.browser.customtabs" ascii wide nocase
        $s4 = "warmup" ascii wide nocase
        $s5 = "mayLaunchUrl" ascii wide nocase
        $s6 = "getExtras" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D  // MZ header (likely embedded binary) OR filesize > 1MB
        and 3 of them
}

Suricata IDS Rule

Detection strategy: Network-level detection is limited for a purely local vulnerability. This rule detects the exfiltration phase where the malicious app transmits collected cross-origin data to a C2 server.

alert http any any -> any any (msg:"CVE-2026-78936 Android CustomTabs Data Exfiltration - Suspicious POST with Token Data"; flow:established,to_server; content:"POST"; http_method; content:"authorization"; http_header_names; content:"cookie"; http_header_names; pcre:"/(token|session|email|oAuth)/Ui"; reference:cve,2026-78936; classtype:trojan-activity; sid:202678936; rev:1;)

Elastic Detection

Detection strategy: EQL to identify a process repeatedly accessing Chrome's debug or activity state, which is atypical for non-system apps.

sequence by host.name, user.name with maxspan=10m
  [process where event.action == "start" and
     process.name == "com.google.android.chrome" and
     process.parent.name == "com.unknown.app"]
  [process where event.action == "start" and
     process.parent.name == "com.unknown.app" and
     process.name == "com.google.android.chrome"]
  | count() > 10

Splunk SPL Query

Detection strategy: Look for Android Syslog (logcat) entries where a non-Chrome UID reads Chrome activity records in a repetitive loop.

index=android sourcetype=logcat 
| rex field=_raw "UID=(?<uid>\d+)" 
| where like(_raw, "%ActivityManager%") 
| stats count as observation_freq by uid, process_name 
| where observation_freq > 50 AND process_name == "com.google.android.chrome" 
| eval is_suspicious = if(observation_freq > 100, "CRITICAL", "REVIEW") 
| table _time, uid, process_name, observation_freq, is_suspicious

Wazuh OSSEC Rule

Detection strategy: Alert when a co-installed app generates a high volume of Android intent events targeting the Chrome CustomTabs service, suggesting probing behavior.

<group name="chromium_mobile,">
    <rule id="102636" level="10">
        <decoded>customtabs_observer</decoded>
        <match>com.google.android.chrome</match>
        <regex>uid=\S+ .*intent.*activity</regex>
        <description>Possible CVE-2026-78936 exploitation attempt - repeated CustomTabs observation by local app</description>
        <group>chromium_mobile,</group>
        <mitre>
            <id>T1534</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED — single source claims patch, not independently confirmed). The only claimed fix is the update to Chrome 152.0.7977.65 on Android, per NVD. No vendor advisory has been independently verified, and no OSV package data is available.

1. Immediate mitigations (until patch verification):

   • Application allowlisting: Restrict Android devices to a managed app catalog; block installation of unknown or third-party sideloaded applications in enterprise environments (via MDM/EMM policies like Android Enterprise).
   • Disable CustomTabs for sensitive apps: Where possible, configure critical enterprise apps to open URLs in the default system browser (or a WebView with strict settings) instead of Chrome CustomTabs.
   • Monitor app permissions: Audit and revoke QUERY_ALL_PACKAGES and accessibility-service permissions from non-essential apps, as these can be abused to observe other processes.

2. Patch/upgrade steps:

   • Update Google Chrome on all Android endpoints to version 152.0.7977.65 or later via the Google Play Store or enterprise managed Play Store.
   • Verify the patch by checking the Chrome version string (chrome://version).
   • Until the patch is independently confirmed (raise confidence from 2/4), do not assume complete remediation; continue monitoring for updates from Google's Chrome Releases blog.

3. Long-term hardening:

   • Implement a zero-trust mobile model: assume co-installed apps can observe other apps; containerize sensitive data in app-level encryption.
   • Enable Android's "Private DNS" and Network Security Config to prevent simple TLS-inspection-based exfiltration.
   • Establish an internal CVE-watch process to re-evaluate this CVE once a vendor advisory is published and EPSS is scored, to assess evolving exploit-in-the-wild probability.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-78936 — Official NVD record; only source claiming the patch and affected version range.
2. Google Chrome Releases (expected): Chrome Releases blog (https://chromereleases.googleblog.com/) — Not yet observed for this CVE; check for version 152.0.7977.65 roll-out confirmation.
3. CWE-203 Reference: https://cwe.mitre.org/data/definitions/203.html — MITRE description of the "Observable Discrepancy" weakness class used to categorize the vulnerability.
4. FIRST.org EPSS: https://www.first.org/epss/ — Monitoring point for EPSS score, currently "Not yet scored", indicating low public exploit confidence.

Threat actor campaigns / exploit-in-the-wild evidence: None known based on the provided data. CISA KEV status is "NO", and no PoC/exploit code is publicly available. Threat actors are not currently known to be actively exploiting this CVE, likely due to the local precondition and medium severity. However, the vulnerability's classification as an information-disclosure side-channel aligns with capabilities observed in existing Android banking trojans (e.g., those using accessibility services to monitor app activity), suggesting a moderate future adaptation risk.