EUVD-2026-50716
GHSA-39qm-ff77-hmv9
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory prerequisite of a prior renderer process compromise; all other metrics align with the vendor-provided vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.
Technical ContextAI
The affected component is the WebView subsystem within Google Chrome on Android, identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. WebView renders web content inside Android applications and is subject to Chrome's multi-process sandbox architecture, where the renderer process operates in a restricted context isolated from the browser process. CWE-20 (Improper Input Validation) identifies the root cause: the WebView fails to adequately validate untrusted input when processing crafted HTML, enabling a same-origin policy bypass that leaks cross-origin data. Critically, this flaw only becomes exploitable after an attacker has already achieved renderer process compromise through a separate vulnerability - placing it firmly in the category of sandbox-escape enablement or data exfiltration post-renderer-compromise primitives.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for Android. Users and administrators should update Google Chrome on Android to version 151.0.7922.72 or later immediately via the Google Play Store or managed device update policies, as referenced in the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control for environments where immediate patching is not possible, restricting the use of WebView-based applications that process untrusted web content can reduce the attack surface; however, this is not a substitute for patching and may break legitimate application functionality. Enterprise MDM policies can be used to enforce minimum Chrome version requirements across managed Android devices.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today