EUVD-2026-50839
GHSA-96pq-v9wp-g6rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via prior exploit
-
DeliveryLure victim to crafted HTML page
-
ExploitSend malformed accessibility data to browser process
-
ExecutionTrigger input-validation flaw in Accessibility
-
PersistEscape sandbox to higher privilege
-
ImpactFull compromise of browser/host context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised Chrome's renderer process - this is an explicit prerequisite stated in the CVE, making it a chained second-stage bug rather than a standalone entry point. The target must be Google Chrome on Android below 151.0.7922.72, and the escape is triggered via a crafted HTML page processed through the Accessibility component, with UI:R meaning the victim must interact (e.g., visit/open the malicious page). Limiting factors: the mandatory prior renderer compromise, the Android-only scope, the requirement of user interaction, and that only pre-151.0.7922.72 builds are vulnerable. There is no confirmed active exploitation (SSVC Exploitation: none; not in KEV) and exploitation is not automatable per CISA SSVC. |
| Impact | Signals conflict and must be weighed carefully. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C, C:H/I:H/A:H = 9.6 Critical) reflects Chromium's convention of treating a hostile renderer as the baseline, so it does NOT capture that the attacker must FIRST compromise the renderer - a substantial precondition the description states explicitly. CISA's SSVC framework aligns with the lower real-world urgency: Exploitation 'none', Automatable 'no', Technical Impact 'total'. EPSS is low at 0.29% (21st percentile) and there is no KEV listing and no public POC, indicating this is not a standalone, mass-exploitable issue. Net: high technical impact (full sandbox escape) but gated behind a prior renderer compromise, making it an important patch for a chained-exploit defense-in-depth posture rather than an emergency drop-everything item on its own. |
| Exploit ScenarioDerived | An attacker first lands a working renderer exploit (for example via a separate memory-corruption bug) when the victim opens a malicious web page in Chrome for Android, gaining code execution inside the sandboxed renderer. Using that foothold, the attacker feeds crafted accessibility data to the browser process, exploiting the input-validation gap to escape the sandbox and gain higher-privileged execution. No public POC for this specific sandbox-escape bug has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox through crafted input handled by the browser's Accessibility component. Rated High by Chromium and CVSS 9.6, it is a second-stage bug typically chained after an initial renderer exploit, giving an attacker a path to full compromise of the browser/host context. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and it is not on CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later, which is the primary and complete fix; on Android this arrives via the Google Play Store update to the Chrome app, so ensure automatic app updates are enabled and force-update managed fleets via MDM. Consult the Chrome Releases advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for the release notes. No standalone workaround exists for the accessibility parsing flaw itself; because exploitation requires a prior renderer compromise, compensating controls should focus on reducing initial renderer-exploit exposure - enable Chrome's Enhanced Safe Browsing (trade-off: sends more browsing metadata to Google), and for high-risk users enable Site Isolation-aware hardening and restrict installation of untrusted extensions. These are risk-reduction measures only and are not substitutes for applying the patched version.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's Accessibility subsystem, the layer that exposes the rendered accessibility tree (a11y) to assistive technologies and cross-process consumers. Because accessibility data flows from the sandboxed renderer to higher-privileged browser-process code, insufficient validation of that untrusted data (CWE-20, Improper Input Validation) at the trust boundary can be abused to corrupt state outside the sandbox. The affected component is the Chromium/Blink accessibility implementation on Android, per the single CPE cpe:2.3:a:google:chrome. Root cause is the classic Chromium pattern where a compromised renderer feeds malformed IPC/serialized structures to a browser-side handler that trusts them, enabling a sandbox escape.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a prior renderer compromise plus a crafted page and user interaction, raising AC to High; successful escape crosses the sandbox boundary (S:C) with total impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
A critical vulnerability in Google Chrome for Android (CVSS 9.6) enables attackers who have compromised the browser's rendering process to escape the sandbox and achieve full browser and device compromise. While no public exploit identified at time of analysis, the vulnerability creates material breach risk for organizations whose users access sensitive applications through Chrome on Android.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB