A high-severity authorization flaw in Google Chrome for Android allows local attackers to achieve arbitrary code execution by leveraging a co-installed malicious application.

This vulnerability involves a missing authorization check within the CustomTabs component, which permits an unauthenticated local attacker to bypass sandbox restrictions when a co-installed application is present on the device.

The ability to execute code outside the application sandbox poses a severe risk to device integrity and user privacy. With a CVSS score of 7.4, this vulnerability represents a high threat, as successful exploitation could lead to full system compromise, unauthorized data access, and the potential for lateral movement within the mobile environment.

Immediate Action: Update Google Chrome to version 152.0.7977.65 or the latest available stable release provided by the Google Play Store.

Proactive Monitoring: Monitor device security logs for unusual inter-process communication patterns or unexpected application behaviors that may indicate sandbox escape attempts.

Compensating Controls: Enforce strict application installation policies and ensure that mobile device management (MDM) solutions are configured to block the installation of untrusted or unauthorized applications.

Public Exploit Available: Unknown

Given the potential for sandbox escape and arbitrary code execution, this vulnerability should be treated with high priority. Users and administrators must ensure that Chrome is updated to the latest patched version across all managed Android devices to eliminate the risk of local exploitation.