EUVD-2026-34639
GHSA-23r4-ccc9-65c9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebView component on Android allows an unauthenticated remote attacker to read data from origins outside the attacker's own domain by enticing a user to visit a crafted HTML page. Affected are all Android Chrome versions prior to 149.0.7827.53. No public exploit exists and SSVC classifies exploitation as none, but the network-accessible, low-complexity attack vector warrants patching for Android-heavy enterprise environments handling sensitive cross-origin content.
Technical ContextAI
CWE-346 (Origin Validation Error) identifies the root cause: Chrome's WebView on Android fails to adequately enforce its same-origin policy, a foundational browser security boundary that prevents one web origin from reading resources belonging to another. WebView is the Android system component that renders web content inside native apps; insufficient policy enforcement within it can bypass the isolation that normally constrains cross-origin reads. The CPE context (Chrome < 149.0.7827.53 on Android) confirms this is strictly a mobile platform issue tied to the Android WebView implementation, not the broader desktop Chromium engine. The CVSS vector AV:N/AC:L/PR:N/UI:R reflects that exploitation is purely network-delivered via a crafted page, requires no attacker credentials, but does require a user to open the malicious content.
RemediationAI
Update Google Chrome on Android to version 149.0.7827.53 or later; this is the vendor-released patch confirmed by Google's stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Users should apply the update via the Google Play Store. For organizations managing Android fleets via EMM or MDM solutions, push the Chrome update as a required app update policy. If immediate patching is not feasible, a targeted compensating control is to restrict or disable the use of in-app WebView components in managed apps that load untrusted cross-origin content - note this may break legitimate app functionality. Blocking user access to untrusted web content via network proxy or DNS filtering reduces exposure but does not eliminate it, as the attacker controls the crafted page. No workaround eliminates the underlying policy enforcement flaw without updating Chrome.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today