EUVD-2026-50816
GHSA-8pgq-9x47-q4gm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts crafted HTML page with malicious PDF payload
-
DeliveryVictim navigates to page on Android Chrome (prior to 151.0.7922.72)
-
ExploitPDF component processes untrusted input without sufficient validation
-
ExecutionCross-origin isolation boundary bypassed
-
ImpactSensitive data from other origins leaked to attacker page
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on an Android device with a version prior to 151.0.7922.72, and must interact with a crafted HTML page that triggers the vulnerable PDF processing code path - user interaction is required and confirmed by UI:R in the CVSS vector. The CVE description specifies a 'local attacker,' which limits the threat model: if this means the attacker must have physical or local network access to direct the victim's browser, the pool of viable attackers is substantially reduced compared to a purely remote scenario. No authentication on the victim's part is required (PR:N), and attack complexity is described as low (AC:L) once the interaction condition is met. The vulnerability is specific to the Android platform and does not appear to affect Chrome on desktop operating systems. |
| Impact | The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact with no complexity barrier once user interaction occurs. However, the CVE description explicitly states 'local attacker,' which conflicts with the AV:N vector - this discrepancy is unresolved in available data and should be verified against the upstream Chromium issue tracker (issues.chromium.org/issues/517129282, which requires authentication to access). If 'local' means physical device access or same-device context, the true attack surface is significantly narrower than AV:N implies. EPSS of 0.18% at the 8th percentile confirms the security community broadly assesses exploitation as unlikely in the near term. No CISA KEV listing and no reported POC code further support a moderate-priority triage posture. The High Chromium severity rating aligns with cross-origin leakage being a meaningful breach of browser security guarantees, but the Android-only scope and user-interaction requirement limit blast radius compared to a full RCE. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing malicious PDF content or PDF-triggering logic designed to exploit the validation gap in Chrome's Android PDF component. When a victim on an Android device visits this page using an unpatched Chrome browser - whether via a phishing link, malicious ad, or QR code - Chrome's PDF processing is triggered without properly validating cross-origin boundaries, causing sensitive data from other origins (such as session tokens, cookies, or local storage content) to be read by the attacker's page. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for Android, detailed in the stable channel update advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Update Chrome on Android to version 151.0.7922.72 or later via the Google Play Store. As a compensating control prior to patching, users can avoid opening PDF content directly in Chrome on Android - using a dedicated offline PDF reader application eliminates the vulnerable code path. Disabling JavaScript or using Chrome's site isolation flags may reduce cross-origin leakage surface but carries significant compatibility trade-offs with modern web applications and is not a reliable substitute for the patch. Enterprise administrators managing Android fleets should prioritize the update through their MDM solution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Google Chrome's PDF rendering subsystem on the Android platform, as identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. The root cause is CWE-20 (Improper Input Validation), meaning Chrome fails to adequately validate untrusted content supplied through PDF processing when that content is embedded or triggered via an HTML page. The cross-origin data leak implies the PDF component does not correctly enforce the Same-Origin Policy or equivalent isolation boundaries under certain input conditions, allowing data from origins other than the attacker's to be read. This is an Android-specific code path, suggesting the vulnerability may relate to Chrome's Android PDF viewer integration rather than the shared Chromium renderer used on desktop platforms.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack delivery is via a crafted HTML page (network vector); user must interact (UI:R); confidentiality-only impact from cross-origin data leak; no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB