CVE-2026-14046: Chrome Android CustomTabs Same-Origin Policy Bypass Vulnerability

Technical summary

CVE-2026-14046 stems from improper implementation of CustomTabs, a Chrome Android feature that allows apps to display web content in a customized in-app browser. The vulnerability permits same-origin policy (SOP) bypass via a specially crafted HTML page. Same-origin policy is the web's primary isolation mechanism, restricting scripts from one origin from accessing data from another. The flaw maps to CWE-346 (Origin Validation Error), indicating the browser fails to correctly validate or enforce origin boundaries. The attack vector is network-based with low complexity, meaning no special conditions or privilege levels are needed, but does require user interaction—specifically, the user must visit or interact with the crafted page within a CustomTabs context.

Business impact

For organizations deploying Android apps that embed Chrome CustomTabs, this vulnerability could allow attackers to inject unauthorized content, steal session tokens, or modify displayed information by bypassing origin restrictions. The impact is primarily integrity-focused; confidentiality and availability are not directly affected. Business continuity risk is moderate: user trust in in-app browsing could be undermined if exploited at scale, and sensitive workflows relying on CustomTabs (e.g., OAuth flows, payment gateways) could face manipulation risks if not patched promptly.

Affected systems

Google Chrome on Android devices running versions prior to 150.0.7871.47 are affected. This includes Chrome on all Android OS versions supported by that browser release. Any application or service relying on Chrome CustomTabs on Android is potentially exposed if users have not updated to the patched version. Desktop Chrome versions are not affected; the vulnerability is specific to the Android CustomTabs implementation.

Exploitability

Exploitability is limited by the user interaction requirement—the victim must visit a crafted HTML page, typically via a link or in-app navigation. No special user privileges are needed, and the attack requires no authentication. An attacker could distribute the malicious page via phishing, malicious advertisements, or compromised websites. Once visited in a CustomTabs context, the flaw permits SOP bypass without additional user action. The lack of KEV (Known Exploited Vulnerability) designation indicates no public evidence of active, widespread exploitation as of the publication date, though this does not preclude future threats.

Remediation

Users should immediately update Google Chrome on Android to version 150.0.7871.47 or later. Developers of Android applications using CustomTabs should verify their users are running patched Chrome versions or implement additional origin validation and content security policies within the app layer. Organizations should communicate update availability to end users and consider blocking unpatched clients if feasible.

Patch guidance

Google Chrome on Android will receive the fix in version 150.0.7871.47. Update via the Google Play Store or auto-update mechanism. For development teams integrating CustomTabs: verify your Chrome dependency meets or exceeds this version. If your application pins or constrains Chrome versions, update those constraints immediately. Test in-app browsing flows, especially OAuth and payment workflows, after patching to confirm no functional regressions. Monitor Chrome release notes for any follow-up security advisories.

Detection guidance

Identify affected devices by checking Chrome version (Settings > About Chrome on Android devices). For organizations with MDM, query device inventory for Chrome version <150.0.7871.47. Monitor network logs for unusual same-origin policy bypasses (though detection at the network level is difficult; log Chrome security warnings if available). Review app analytics for unexpected content modification or session anomalies that might indicate exploitation. Set up alerts for user reports of unexpected in-app behavior when using CustomTabs-based features.

Why prioritize this

Although Chromium assigned 'Low' severity, the CVSS 4.3 MEDIUM rating and CWE-346 (origin validation) warrant prioritization because SOP bypass is a fundamental trust violation. The attack is practical—requiring only user interaction, not exploitation of a memory corruption or complex chain—making it more likely to be targeted in the wild over time. Android's large installed base and the widespread use of in-app browsing for authentication and financial transactions elevate business risk. The absence of active exploitation does not reduce urgency; proactive patching prevents attackers from developing and deploying exploits.

Risk score, explained

CVSS 4.3 reflects a network-reachable flaw with low attack complexity, requiring only user interaction, with low integrity impact but no confidentiality or availability impact. The MEDIUM severity classification is appropriate because SOP bypass—though scoped to integrity—is a class of attack that can undermine trust and enable content injection, credential theft via session manipulation, and malware injection. The score does not assume active exploitation or widespread use, but the nature of the vulnerability (web security boundary violation) justifies closer monitoring than the Chromium 'Low' label alone might suggest.

Frequently asked questions