{"id":"CVE-2026-126862","kind":"vulnerability","aliases":["CVE-2026-126862"],"related":[],"title":"Chrome for Android: input validation flaw lets local app bypass web origin policy","description":"Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High)","summary":"Google Chrome on Android before 157.0.8103.78 has an input validation flaw in its core code. A malicious app installed on the same phone can bypass the web origin policy, which normally keeps one site from reading another site's data.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","chrome","runtime"],"not_affected_if":["chrome-up-to-date","no-co-installed-malicious-app"],"how_to_check":"- Open Chrome, go to the menu, then Settings > About Chrome, and read the version number.\n- Compare the installed version with `157.0.8103.78`.","fix":"- Google Chrome for Android: upgrade to `157.0.8103.78` or later.","status":"open","published_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","triaged_at":"2026-11-11T23:33:26+00:00","updated_at":"2026-11-11T23:33:26+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T23:33:26Z","model":"claude-haiku-5-5","output":{"fix":"- Google Chrome for Android: upgrade to `157.0.8103.78` or later.","reach":"local","title":"Chrome for Android: input validation flaw lets local app bypass web origin policy","impact":"medium","summary":"Google Chrome on Android before 157.0.8103.78 has an input validation flaw in its core code. A malicious app installed on the same phone can bypass the web origin policy, which normally keeps one site from reading another site's data.","audience":"everyone","category":"runtime","nicknames":[],"who_cares":["chrome","android"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"a co-installed app reads web data from other origins","analyst_note":"Confirm the fixed version and any exploitation status from the Chrome Releases blog.","how_to_check":"- Open Chrome, go to the menu, then Settings > About Chrome, and read the version number.\n- Compare the installed version with `157.0.8103.78`.","plain_action":"Update Chrome on your Android phone to version 157.0.8103.78 or later through the Google Play Store.","product_name":"","needs_analyst":false,"not_affected_if":["chrome-up-to-date","no-co-installed-malicious-app"],"who_is_affected":"Any Android device running Chrome before 157.0.8103.78 is exposed, and the attacker needs a malicious app already installed on the same device. Desktop Chrome, iOS, and Android devices on a newer Chrome version are not covered by this entry.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4520,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126862':16A,19A '-2026':15A,18A '157.0.8103.78':28B,76C 'allow':77C 'android':3A,20B,26B,73C 'anoth':59B 'app':9A,40B,91C 'attack':80C 'bypass':10A,47B,82C 'chrome':1A,21B,24B,70C 'chromium':92C 'co':89C 'co-instal':88C 'code':37B 'core':36B,67C 'cve':14A,17A 'data':62B 'flaw':6A,33B 'googl':23B,69C 'high':95C 'improp':63C 'input':4A,31B,64C 'instal':41B,90C 'keep':54B 'let':7A 'local':8A,79C 'malici':39B 'normal':53B 'one':55B 'origin':12A,50B,84C 'phone':45B 'polici':13A,51B,85C 'prior':74C 'read':58B 'runtim':22B 'secur':93C 'sever':94C 'site':56B,60B 'valid':5A,32B,65C 'via':86C 'web':11A,49B,83C","nicknames":[],"mitigations":[],"who_affected":"Any Android device running Chrome before 157.0.8103.78 is exposed, and the attacker needs a malicious app already installed on the same device. Desktop Chrome, iOS, and Android devices on a newer Chrome version are not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Chrome on your Android phone to version 157.0.8103.78 or later through the Google Play Store.","pkeys":[],"ptokens":[],"labels":["android","chrome","high","runtime"],"campaign_type":null,"search_a":"'-126862':16A,19A '-2026':15A,18A 'android':3A 'app':9A 'bypass':10A 'chrome':1A 'cve':14A,17A 'flaw':6A 'input':4A 'let':7A 'local':8A 'origin':12A 'polici':13A 'valid':5A 'web':11A","search_b":"'157.0.8103.78':28B 'android':20B,26B 'anoth':59B 'app':40B 'bypass':47B 'chrome':21B,24B 'code':37B 'core':36B 'data':62B 'flaw':33B 'googl':23B 'input':31B 'instal':41B 'keep':54B 'malici':39B 'normal':53B 'one':55B 'origin':50B 'phone':45B 'polici':51B 'read':58B 'runtim':22B 'site':56B,60B 'valid':32B 'web':49B","search_c":"'157.0.8103.78':76C 'allow':77C 'android':73C 'app':91C 'attack':80C 'bypass':82C 'chrome':70C 'chromium':92C 'co':89C 'co-instal':88C 'core':67C 'googl':69C 'high':95C 'improp':63C 'input':64C 'instal':90C 'local':79C 'origin':84C 'polici':85C 'prior':74C 'secur':93C 'sever':94C 'valid':65C 'via':86C 'web':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T23:17:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126862","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126862","severity":null,"published_at":"2026-11-11T23:17:14+00:00","modified_at":"2026-11-11T23:17:14+00:00","first_seen_at":"2026-11-11T23:29:37+00:00","fetched_at":"2026-11-11T23:29:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}