EUVD-2026-34748
GHSA-g8j6-wgqm-2948
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation policy bypass in Google Chrome on Android (prior to 149.0.7827.53) enables a remote attacker who has already achieved renderer process compromise to circumvent navigation restrictions through a specially crafted HTML page. The vulnerability carries a CVSS integrity impact of High (I:H) with no confidentiality or availability impact, indicating the primary risk is unauthorized navigation to restricted targets - a technique commonly used to chain into further exploitation. No public exploit identified at time of analysis, and EPSS of 0.02% (6th percentile) reflects negligible current exploitation probability; however, its value as a chaining primitive in multi-stage browser attacks warrants attention.
Technical ContextAI
The vulnerability resides in Chrome's Navigation component and is classified as CWE-20 (Improper Input Validation), specifically insufficient enforcement of navigation policies within the browser's security model on Android. Modern Chromium-based browsers use a multi-process architecture in which the renderer process is sandboxed and subject to strict navigation policies enforced by the browser process. When these policies are insufficiently validated, a compromised renderer can craft navigation requests that should be blocked - such as cross-origin navigations to restricted schemes or protected internal pages - but are instead permitted. This is platform-specific to Chrome on Android (versions prior to 149.0.7827.53), as confirmed by the ENISA EUVD entry EUVD-2026-34748 and the affected version range from EUVD data. The Chromium issue tracker reference (issues.chromium.org/issues/502173136) contains additional technical detail.
RemediationAI
The primary remediation is to update Google Chrome on Android to version 149.0.7827.53 or later. The patch is confirmed available per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Android users should update via the Google Play Store or Chrome's built-in update mechanism. Because exploitation requires a pre-compromised renderer process, organizations may also reduce chaining risk by ensuring other Chrome vulnerabilities are patched concurrently and by enabling Chrome's Site Isolation feature on Android where supported, as this limits cross-site renderer access. Restricting access to sensitive internal navigation targets at the network or application layer can reduce the impact of a successful bypass. No workaround is available that eliminates the navigation policy enforcement gap itself without applying the patch.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today