CVE-2026-106405

Analyzed Analyzed - Analysis Complete

Race Condition in CustomTabs in Google Chrome on Android

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Chrome

Description

Race condition in CustomTabs in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106405

EUVD

EUVD-2026-93721

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This is a race condition vulnerability in CustomTabs in Google Chrome on Android. It allows a local attacker to bypass web origin policy by exploiting timing issues when a co-installed app is present.

Detection Guidance

This vulnerability is specific to Google Chrome on Android and involves a race condition in CustomTabs. Detection would require checking the installed version of Chrome on Android devices and verifying if it is prior to 155.0.8059.39. No direct network detection commands are applicable.

Impact Analysis

A local attacker could exploit this to bypass security restrictions, potentially accessing sensitive data or performing unauthorized actions through a malicious co-installed app.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it involves a local attacker bypassing web origin policy via a co-installed app on Android. No evidence suggests it impacts data protection or privacy requirements under these regulations.

Mitigation Strategies

Update Google Chrome on Android to version 155.0.8059.39 or later to address the race condition in CustomTabs.

Hi! I’m here to help you understand CVE-2026-106405. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70