EUVD-2026-50697
GHSA-h95q-chxx-cxjm
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L
Renderer pre-compromise drives AC:H; UI spoofing enables credential harvest (C:L) and payment flow manipulation (I:L) with no plausible availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's Payments subsystem, which processes untrusted HTML content without adequate sanitization or validation of rendered UI elements. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome versions prior to 151.0.7922.72 carry this flaw, scoped exclusively to the Android platform. Architecturally, Chrome enforces a process sandbox separating the renderer from the browser process - this vulnerability exists at that trust boundary, where the Payments component in the privileged browser process fails to reject or neutralize malicious signals originating from a compromised renderer. This is a multi-stage trust boundary failure: the renderer sandbox is assumed to contain an already-hostile process before the Payments flaw is reachable.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later - this is the vendor-released patch confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Updates can be applied via the Google Play Store or Chrome's built-in Settings > About Chrome update mechanism. Since exploitation requires a prior renderer compromise, organizations with elevated risk tolerance can reduce attack surface by ensuring Chrome's Site Isolation and sandbox hardening remain enabled (default state) - disabling these features would broaden the precondition landscape. There is no known workaround that eliminates the Payments validation flaw itself without patching; compensating controls should be treated as secondary measures only. Enterprise deployments using Chrome Browser Cloud Management should push the 151.0.7922.72 update via managed policy.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today