EUVD-2026-40783
GHSA-7ccw-mj8q-vff7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the renderer-compromise prerequisite not captured in the official vector; PR:N and UI:R retained as the crafted page requires no auth but needs interaction.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome for Android (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information through a crafted HTML page, exploiting an inappropriate implementation in Chrome's Input component (CWE-200). The attack requires both a pre-existing renderer compromise and user interaction with a malicious page, creating a chained exploitation prerequisite that substantially lowers real-world risk below what the 6.5 CVSS score implies. No public exploit has been identified and SSVC confirms exploitation status as none, consistent with EPSS placing this in the bottom 7th percentile of exploitation likelihood.
Technical ContextAI
The vulnerability resides in the Input handling subsystem within Chromium's renderer on Android, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw represents a divergence between Chrome's Android-specific Input implementation and the browser's Same-Origin Policy enforcement, allowing cross-origin data to be read when the renderer is in a compromised state. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome builds, with the EUVD data narrowing the vulnerable population to versions below 150.0.7871.47 specifically on Android. The platform specificity suggests the issue is tied to Android's touch or software keyboard Input model, which differs from desktop Input paths and contains a boundary check or isolation gap absent on other platforms. The scope is Unchanged (S:U), confirming the leak does not cross process privilege boundaries beyond what the already-compromised renderer can already reach.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later, which contains the vendor-released patch as documented in the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Android users should ensure automatic updates are enabled via the Google Play Store to receive this patch promptly. Since this vulnerability requires a prior renderer compromise to be exploitable, organizations should also prioritize patching any co-present Chromium renderer RCE vulnerabilities, as those form the required prerequisite; without renderer compromise, this flaw cannot be triggered. Enabling Chrome's strict site isolation on Android (where supported) reduces the lateral blast radius if a renderer is compromised. No workarounds specific to this Input flaw are documented in the available references.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today