CVE-2026-126862
Description
A flaw was found in Google Chrome on Android. Improper input validation in the Core component allows a local attacker to bypass web origin policy restrictions using a co-installed application. This vulnerability may allow a malicious application on the device to access sensitive data across different web domains or perform unauthorized actions.
Statement
This vulnerability is rated as Important because a failure in origin verification could enable an attacker to circumvent same-origin boundaries and compromise cross-site confidentiality and integrity without requiring user interaction. However, this flaw targets mobile application interaction models on the Android platform, requiring a locally co-installed program to trigger the defect. Because Red Hat Enterprise Linux desktop environments do not implement the Android application framework, standard deployments are not directly exposed to this attack vector.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context
An attacker can access any functionality that is inadvertently accessible to the source.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
