EUVD-2026-34639
GHSA-23r4-ccc9-65c9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebView component on Android allows an unauthenticated remote attacker to read data from origins outside the attacker's own domain by enticing a user to visit a crafted HTML page. Affected are all Android Chrome versions prior to 149.0.7827.53. No public exploit exists and SSVC classifies exploitation as none, but the network-accessible, low-complexity attack vector warrants patching for Android-heavy enterprise environments handling sensitive cross-origin content.
Technical ContextAI
CWE-346 (Origin Validation Error) identifies the root cause: Chrome's WebView on Android fails to adequately enforce its same-origin policy, a foundational browser security boundary that prevents one web origin from reading resources belonging to another. WebView is the Android system component that renders web content inside native apps; insufficient policy enforcement within it can bypass the isolation that normally constrains cross-origin reads. The CPE context (Chrome < 149.0.7827.53 on Android) confirms this is strictly a mobile platform issue tied to the Android WebView implementation, not the broader desktop Chromium engine. The CVSS vector AV:N/AC:L/PR:N/UI:R reflects that exploitation is purely network-delivered via a crafted page, requires no attacker credentials, but does require a user to open the malicious content.
RemediationAI
Update Google Chrome on Android to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by Google's stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users should apply the update via the Google Play Store. For organizations managing Android fleets via EMM or MDM solutions, push the Chrome update as a required app update policy. If immediate patching is not feasible, a targeted compensating control is to restrict or disable the use of in-app WebView components in managed apps that load untrusted cross-origin content - note this may break legitimate app functionality. Blocking user access to untrusted web content via network proxy or DNS filtering reduces exposure but does not eliminate it, as the attacker controls the crafted page. No workaround eliminates the underlying policy enforcement flaw without updating Chrome.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today