EUVD-2026-34758
GHSA-jqx5-hg9f-r3hf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessStage malicious file on Android device
-
DeliveryUser opens file in Chrome Reader Mode
-
ExploitReader Mode fails input validation
-
ExecutionBypass navigation restrictions
-
ImpactAccess or tamper with restricted content
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the victim run a vulnerable Chrome for Android build (pre-149.0.7827.53), that Reader Mode be the rendering path for the attacker-supplied file, and that the attacker be able to place a malicious file on the device or get it loaded locally (the CVSS AV:L local vector). Limiting factors: the attack is local rather than network-reachable, it is specific to the Android platform's Chrome Reader Mode (desktop/iOS not implicated), and despite CVSS UI:N the description implies the user must actually open the malicious file in Reader Mode for the bypass to trigger. |
| Impact | Signals are mixed and lean lower than the headline CVSS suggests. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) scores 7.7 driven by High integrity and availability impact with local attack vector, while EPSS is extremely low at 0.02% (4th percentile) and CISA SSVC categorizes Exploitation as 'none' and Automatable as 'no' (though Technical Impact is 'total'). Chromium itself rated this 'Low' severity, and the issue is not in CISA KEV. The CVSS UI:N is somewhat in tension with the description's requirement that the user open a 'malicious file' on Android - verify with vendor whether file open constitutes user interaction in their scoring model. Realistically this is a low-priority patch-with-next-cycle issue, not an emergency. |
| Exploit ScenarioDerived | An attacker delivers a crafted file (for example via email attachment, messaging app, or sideloaded download) to an Android device and convinces the user to open it in Chrome's Reader Mode. The malformed input fails validation, allowing the rendered context to navigate to a location it should not reach, which the attacker can leverage to read or manipulate content tied to other origins or to disrupt browser state. No public proof-of-concept has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 05, 2026
Navigation restriction bypass in Google Chrome on Android prior to 149.0.7827.53 allows a local attacker to circumvent Reader Mode input validation by supplying a malicious file. No public exploit identified at time of analysis, and EPSS scores exploitation probability at just 0.02% (4th percentile), but Google has released a fix in the stable channel. Chromium internally rates this as Low severity despite the elevated NVD CVSS of 7.7.
RemediationAI
Vendor-released patch: update Google Chrome on Android to 149.0.7827.53 or later via Google Play, as announced in the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. In managed-device fleets, push the updated Chrome APK through MDM and verify rollout against version 149.0.7827.53. As a compensating control before patching, instruct users to avoid opening untrusted local files (file:// scheme content, downloaded HTML/MHTML) in Chrome and to disable Reader Mode under chrome://flags or via enterprise policy, accepting the trade-off that accessibility users relying on Reader Mode will lose that simplified-rendering capability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Reader Mode feature on the Android platform, which reformats web content for distraction-free reading. The root cause is CWE-20 (Improper Input Validation): Reader Mode insufficiently validates untrusted input from a file source, permitting navigation constraints that normally isolate the rendering context to be bypassed. Reader Mode operates as a privileged Chrome view that strips page chrome and re-renders DOM content, so weak input handling there can break expected origin/scheme boundaries that Chrome's navigation policies enforce.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
Executive ViewAI
Google Chrome on Android versions prior to 149.0.7827.53 contain a Reader Mode input validation bypass allowing local attackers to circumvent security controls via malicious files. While assigned CVSS 7.7, this vulnerability has no public exploit identified and carries exploitation probability of 0.02% per EPSS; Chromium internally rates it as low severity. Organizations should prioritize patching across mobile device fleets to maintain defense-in-depth posture and reduce attack surface.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Security Fixes (149.0.7827.53)
View all 72Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB