EUVD-2026-50807
GHSA-5mm6-fj7r-pv27
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Delivered via a web page (AV:N, UI:R) with no target credentials (PR:N); sandbox breakout yields a scope change (S:C) and full browser-process compromise (C/I/A:H), though a prior renderer exploit is a practical prerequisite.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted untrusted input to the Web Authentication (WebAuthn) component. Rated High severity by Chromium and scored CVSS 9.6, it is a second-stage bug chained after an initial renderer exploit rather than a standalone remote compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have ALREADY compromised Chrome's renderer process on the target Android device - this is a chained sandbox-escape bug, not a standalone entry point, and cannot be triggered without that prior foothold. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6) reflects network reachability, low complexity, no privileges, a scope change (sandbox boundary crossed), and full CIA impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first lures a victim to a malicious web page that exploits a separate renderer-process vulnerability to gain code execution inside Chrome's sandbox on Android. From that foothold, the attacker issues crafted WebAuthn requests with malformed untrusted input that the browser process fails to validate, escaping the sandbox to run with the browser's higher privileges. … |
| Remediation | Vendor-released patch: update Google Chrome for Android to 151.0.7922.72 or later, per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this is delivered through the Google Play Store, so ensure automatic app updates are enabled and force-update managed fleets via MDM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: notify Android device users and IT teams to enable automatic Chrome updates in the Google Play Store and verify current Chrome version. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today