EUVD-2026-34748
GHSA-g8j6-wgqm-2948
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation policy bypass in Google Chrome on Android (prior to 149.0.7827.53) enables a remote attacker who has already achieved renderer process compromise to circumvent navigation restrictions through a specially crafted HTML page. The vulnerability carries a CVSS integrity impact of High (I:H) with no confidentiality or availability impact, indicating the primary risk is unauthorized navigation to restricted targets - a technique commonly used to chain into further exploitation. No public exploit identified at time of analysis, and EPSS of 0.02% (6th percentile) reflects negligible current exploitation probability; however, its value as a chaining primitive in multi-stage browser attacks warrants attention.
Technical ContextAI
The vulnerability resides in Chrome's Navigation component and is classified as CWE-20 (Improper Input Validation), specifically insufficient enforcement of navigation policies within the browser's security model on Android. Modern Chromium-based browsers use a multi-process architecture in which the renderer process is sandboxed and subject to strict navigation policies enforced by the browser process. When these policies are insufficiently validated, a compromised renderer can craft navigation requests that should be blocked - such as cross-origin navigations to restricted schemes or protected internal pages - but are instead permitted. This is platform-specific to Chrome on Android (versions prior to 149.0.7827.53), as confirmed by the ENISA EUVD entry EUVD-2026-34748 and the affected version range from EUVD data. The Chromium issue tracker reference (issues.chromium.org/issues/502173136) contains additional technical detail.
RemediationAI
The primary remediation is to update Google Chrome on Android to version 149.0.7827.53 or later. The patch is confirmed available per the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. Android users should update via the Google Play Store or Chrome's built-in update mechanism. Because exploitation requires a pre-compromised renderer process, organizations may also reduce chaining risk by ensuring other Chrome vulnerabilities are patched concurrently and by enabling Chrome's Site Isolation feature on Android where supported, as this limits cross-site renderer access. Restricting access to sensitive internal navigation targets at the network or application layer can reduce the impact of a successful bypass. No workaround is available that eliminates the navigation policy enforcement gap itself without applying the patch.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today