EUVD-2026-40573
GHSA-ww75-9mpc-wvr2
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory prerequisite of a prior renderer compromise; all other metrics align with a network-delivered, user-interaction-required, confidentiality-only information disclosure.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's NFC implementation on Android exposes sensitive information to attackers who have already compromised the renderer process. Chrome versions prior to 150.0.7871.47 on Android fail to properly validate origins when handling NFC interactions, allowing a renderer-level attacker to read data across origin boundaries via a crafted HTML page. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at the 11th percentile, indicating low observed exploitation probability despite the theoretical confidentiality impact.
Technical ContextAI
The vulnerability resides in Chrome's NFC (Near Field Communication) Web API implementation on Android, classified under CWE-346 (Origin Validation Error). CWE-346 describes failures to adequately verify the origin of data or communications, which in a browser context means the NFC subsystem does not correctly enforce the same-origin policy. The affected product is Google Chrome on Android prior to version 150.0.7871.47 (CPE implied from EUVD affected version range: Chrome < 150.0.7871.47). Chrome's multi-process architecture sandboxes the renderer in a lower-privilege process, but this vulnerability assumes that sandbox has already been breached - the NFC origin check failure then becomes the mechanism for a cross-origin read, effectively a second stage in an exploit chain. The Web NFC API, only available on Android Chrome, allows web pages to interact with NFC tags; the inappropriate implementation here permits a compromised renderer to misuse this channel to bypass origin isolation.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later, which is confirmed to contain the fix per the vendor's stable channel update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android typically auto-updates via Google Play; administrators managing enterprise Android fleets via EMM solutions (such as Google Workspace or Microsoft Intune) should push the update through managed app channels and verify version compliance. As a compensating control prior to patching, organizations may consider disabling or restricting access to Web NFC API permissions at the enterprise browser policy level using Chrome's managed policies (WebNfcAllowed can be set to false), though this trades off legitimate NFC web application functionality. Given that exploitation requires a prior renderer compromise, ensuring Chrome is fully patched against all current renderer-level vulnerabilities (i.e., no outstanding Chromium sandbox escapes) substantially reduces the practical risk of this flaw being reachable.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today