CVE-2026-15115: Chrome Android Same-Origin Policy Bypass – Patch Guidance

Technical summary

CVE-2026-15115 is a same-origin policy (SOP) bypass vulnerability in the WebAppInstalls component of Google Chrome for Android. The root cause is inadequate input validation (CWE-20) when processing untrusted data. The flaw allows a local attacker to circumvent browser isolation boundaries via a crafted HTML page, potentially gaining unauthorized access to sensitive data from other origins. Google classified this as a High-severity issue in Chromium's internal rating system, though the CVSS 3.1 score of 3.3 (LOW) reflects the requirement for local presence and user interaction.

Business impact

While the CVSS score is low, the business implications warrant attention. A successful exploit could expose sensitive user data across multiple web origins, compromising the integrity of browser-based sessions and potentially affecting users of web applications that handle sensitive information (banking, email, corporate SaaS platforms). Organizations supporting Android users should prioritize patching to maintain user trust and reduce data breach risk, particularly in environments where employees access critical applications via mobile Chrome.

Affected systems

Google Chrome on Android versions prior to 150.0.7871.115 are affected. Desktop and iOS versions of Chrome are not impacted by this specific vulnerability. The vulnerability requires local device access and user interaction, so risk is primarily to individual Android device users rather than server infrastructure. Organizations managing Android devices through mobile device management (MDM) solutions should verify patch deployment across their fleet.

Exploitability

Exploitability is constrained by the local-access and user-interaction requirements encoded in the CVSS vector (AV:L, UI:R). An attacker must already have presence on the Android device and convince a user to visit a malicious webpage. The low barrier to crafting a malicious HTML page means that once a user visits such a page, the vulnerability can be reliably triggered. This is not remotely exploitable without an intermediate vector (such as phishing or social engineering), and passive drive-by attacks are unlikely.

Remediation

Update Google Chrome on Android to version 150.0.7871.115 or later. Users should enable automatic updates in the Google Play Store to receive patches promptly. Organizations managing Android devices should push this update through their MDM solution and verify compliance. No workaround is available; patching is the only mitigation.

Patch guidance

Patch availability: Google Chrome 150.0.7871.115 and later. Deployment approach: For consumer users, enable automatic updates via Google Play Store settings. For enterprise Android deployments, use your MDM platform (Microsoft Intune, Samsung Knox, MobileIron, etc.) to deploy the update to managed devices. Verify patch application by checking Settings > Apps > Chrome > About Chrome, which displays the installed version. Target a rapid deployment timeline given the nature of the vulnerability, even though active exploitation appears unlikely based on KEV status.

Detection guidance

Monitor Chrome version numbers across your Android device inventory through your MDM solution or Mobile Application Management (MAM) platform. If you operate a web application, you may detect exploitation attempts through anomalous same-origin policy violations in browser console logs or unusual cross-origin access patterns in your web server logs, though evidence would be device-side and not visible server-side. Prioritize visibility into Chrome versions in use across your organization's Android fleet.

Why prioritize this

Although the CVSS score is low and the vulnerability is not listed on the CISA KEV catalog, patching should still be prioritized because: (1) same-origin policy bypass is a foundational browser security mechanism; (2) the fix is readily available and deployment is straightforward through automatic updates; (3) the vulnerability affects a widely used browser on a widely deployed platform. Organizations should address this as part of standard patch management cycles rather than as an emergency, but not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the local-access requirement (AV:L), low attack complexity (AC:L), lack of privileges needed (PR:N), and the necessity for user interaction (UI:R). The impact is limited to confidentiality (C:L), with no impact on integrity or availability. The score appropriately captures the reduced risk compared to remote or privilege-escalation vulnerabilities, but does not fully account for the criticality of the same-origin policy as a security boundary. Security teams should interpret this as 'low immediate risk' rather than 'negligible risk,' and treat patching as routine rather than emergency.

Frequently asked questions