EUVD-2026-50848
GHSA-3rr2-3mr9-ff26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise Chrome renderer process
-
DeliveryLure victim to crafted HTML page
-
ExploitTrigger use-after-free in WebView
-
ExecutionCorrupt object across sandbox boundary
-
ImpactEscape sandbox into browser process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process on Android - this is an explicit prerequisite in the CVE description and is the primary limiting factor; the flaw is a sandbox-escape primitive, not a standalone remote entry point. It further requires user interaction (UI:R): the victim must open the attacker's crafted HTML page in Chrome or a WebView-embedding app on Android. Exploitation is limited to Google Chrome / Android WebView versions prior to 151.0.7922.72 on the Android platform, and the high attack complexity (AC:H) reflects the difficulty of chaining a working renderer compromise with reliable cross-boundary memory-corruption control. |
| Impact | The signals are mixed and must be read together. CVSS is 8.3 (High) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H: network vector, high attack complexity, user interaction required, and a scope change (S:C) reflecting the sandbox-boundary crossing that drives the high score. Critically, the description states the attacker must have ALREADY compromised the renderer process, meaning this is not a first-stage remote exploit but a chaining primitive that presupposes a separate renderer bug; that precondition is the reason for AC:H and is only partially captured by PR:N. EPSS is low (0.21%, 11th percentile), there is no CISA KEV listing, and no POC is indicated, so this is a real but not urgent priority: high impact if chained, but exploitation requires attacker capability (a working renderer compromise) that opportunistic actors typically lack. Treat it as important defense-in-depth patching rather than an emergency. |
| Exploit ScenarioDerived | An attacker first compromises the Chrome renderer process on an Android device using a separate memory-corruption bug, then lures the victim to open a crafted HTML page (satisfying the required user interaction). The page triggers the use-after-free in WebView to corrupt memory across the sandbox boundary, escalating from the constrained renderer into the higher-privileged browser process. No public POC has been identified, and the high attack complexity reflects the need to first control the renderer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.
RemediationAI
Vendor-released patch: update Google Chrome and Android System WebView to 151.0.7922.72 or later, which is the primary and recommended fix. On Android these components update through Google Play, so ensure automatic app updates are enabled and force-update the Android System WebView and Chrome apps across managed fleets via MDM. If immediate patching is not possible, the practical compensating control is to reduce exposure to untrusted web content by restricting browsing to trusted sites and limiting installation of apps that render arbitrary remote HTML in WebView, accepting the usability trade-off of reduced browsing freedom; note that because this bug requires a prior renderer compromise, keeping the browser fully patched also closes the renderer-stage bugs needed to chain into it. Consult the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html) for authoritative version guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in Android WebView, the system component built on the Chromium engine that renders web content inside native Android apps and the Chrome browser. Chromium enforces a multi-process security model in which untrusted web content runs in a low-privilege, sandboxed renderer process isolated from the more privileged browser process. CWE-416 (Use-After-Free) here is described as an 'object lifecycle issue': an object is freed while a reference to it remains reachable, so subsequent access operates on reclaimed or attacker-controlled memory. When triggered across the renderer/browser trust boundary, such memory corruption can be leveraged to escape the sandbox. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product as Google Chrome, with the Android WebView code path being the specific attack surface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page (AV:N, UI:R) but requires a prior renderer compromise, making it hard to chain (AC:H); the sandbox escape crosses a trust boundary (S:C) with full browser-process impact (C/I/A:H).
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome's Android WebView contains a sandbox escape vulnerability (CVE-2026-17722) affecting versions prior to 151.0.7922.72. This privilege escalation, which requires a renderer process to be previously compromised, could enable attackers to access sensitive data and system resources on affected Android devices. The organization must prioritize patching all mobile devices to Chrome 151.0.7922.72 or later.
Apply vendor patch. Until full deployment is achieved, restrict WebView usage in applications accessing sensitive data and implement additional controls prohibiting execution of untrusted web content within business applications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB