PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-78936 Google CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-25T21:17:49.383Z and has not been modified since then. CVE-2026-78936 is an observable discrepancy in CustomTabs in Google Chrome on Android prior to 152.0.7977.65. This vulnerability allows a local attacker to obtain cross-origin data via a co-installed app. The issue has a CVSS score of 2.9 and is rated as Medium by Chromium security severity. Defenders should prioritize reviewing Chrome browser updates and ensuring that the latest version is deployed to mitigate potential risks associated with this vulnerability. The evidence provided is limited to public CVE and NVD records, and defenders should verify Chrome browser updates are applied and monitor for potential exploitation attempts.

Vendor
Google
Product
Chrome
CVSS
LOW 2.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-25
Original CVE updated
2026-08-31
Advisory published
2026-08-25
Advisory updated
2026-08-31

Who should care

Defenders responsible for managing Google Chrome deployments on Android devices should be aware of this vulnerability and take action to update Chrome to version 152.0.7977.65 or later. This includes IT teams managing Chrome browser updates, security teams monitoring for potential exploitation attempts, and operators responsible for ensuring the security of Chrome deployments on Android devices.

Technical summary

CVE-2026-78936 is an observable discrepancy in CustomTabs in Google Chrome on Android prior to 152.0.7977.65. This vulnerability allows a local attacker to obtain cross-origin data via a co-installed app. The issue has a CVSS score of 2.9 and is rated as Medium by Chromium security severity. Defenders should prioritize reviewing Chrome browser updates and ensuring that the latest version is deployed to mitigate potential risks associated with this vulnerability.

Defensive priority

Defenders should prioritize reviewing Chrome browser updates and ensuring that the latest version (152.0.7977.65 or later) is deployed to mitigate potential risks associated with this vulnerability.

Recommended defensive actions

  • Review and apply Chrome browser updates to ensure version 152.0.7977.65 or later is deployed.
  • Monitor for potential exploitation attempts and anomalous activity.
  • Verify that co-installed apps are properly isolated and do not pose a risk to Chrome data.
  • Perform an inventory of Chrome deployments on Android devices to identify potential exposure.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE-2026-78936 record indicates an observable discrepancy in CustomTabs in Google Chrome on Android prior to 152.0.7977.65, allowing a local attacker to obtain cross-origin data via a co-installed app. The Chromium security severity is rated as Medium with a CVSS score of 2.9. Defenders should verify Chrome browser updates are applied and monitor for potential exploitation attempts. Evidence is limited to public CVE and NVD records.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-78936 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-78936

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-78936 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-78936

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.