EUVD-2026-40610
GHSA-28h2-99h6-qrhg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects required renderer pre-compromise; S:C reflects SOP bypass crossing origin boundaries; C:N and A:N match description's integrity-only impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Same-origin policy bypass in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to perform cross-origin integrity violations by serving a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. This is explicitly a chained attack requiring a pre-existing renderer compromise, making it a second-stage exploit rather than a standalone entry point. No public exploit code exists and no public exploitation has been confirmed at time of analysis.
Technical ContextAI
Chrome's WebView is the Chromium-based rendering engine exposed to Android applications, including Chrome itself, for displaying web content. The vulnerability stems from CWE-20 (Improper Input Validation) within the WebView layer - specifically, inputs related to cross-origin resource access are not sufficiently validated after the renderer process has been compromised. The same-origin policy (SOP) is a fundamental browser security boundary preventing documents from one origin from reading or writing data belonging to another; a bypass allows a compromised renderer to reach across that boundary and modify content or state in other origins. The Chromium security team rated this Medium severity internally. Affected CPE corresponds to Google Chrome for Android prior to version 150.0.7871.47, as confirmed by the EUVD version range 'Chrome 150.0.7871.47 < 150.0.7871.47'.
RemediationAI
The primary fix is to update Chrome for Android to version 150.0.7871.47 or later, available via the Google Play Store or the Chrome Releases advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Because exploitation requires a prior renderer compromise, mitigating the renderer attack surface also reduces exposure: organizations can enforce Android enterprise policies to restrict the use of WebView-based applications in high-risk environments, though this may break functionality for apps that embed WebView. Enabling Chrome's built-in site isolation on Android (where supported) can reduce the blast radius of a renderer compromise. No workaround eliminates the SOP bypass itself without patching. The upstream Chromium issue tracker reference is https://issues.chromium.org/issues/511784747.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today