CVE-2026-91717

Received Received - Intake

Missing Authorization in Google Chrome for Android

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: Chrome

Description

Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-91717

EUVD

EUVD-2026-79971

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 153.0.8010.47 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Missing authorization in Android in Google Chrome on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-installed app.

Impact Analysis

A local attacker could exploit this to access sensitive information through another app installed on the same device.

Compliance Impact

This vulnerability allows a local attacker to obtain sensitive information via a co-installed app, which could lead to unauthorized data access. This may violate GDPR's data protection principles and HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Update Google Chrome on Android to version 153.0.8010.47 or later to address the missing authorization vulnerability.

Hi! I’m here to help you understand CVE-2026-91717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70