EUVD-2026-50765
GHSA-frx2-g4p6-x329
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer via separate bug
-
DeliveryServe crafted HTML page
-
ExploitAbuse Speech policy enforcement gap
-
ExecutionEscalate privileges beyond sandbox
-
ImpactGain higher-privileged code execution
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process on Android - this bug is a second-stage privilege escalation, not an initial-access vector. The attacker must then deliver a crafted HTML page to the compromised renderer, and the CVSS vector requires user interaction (UI:R) plus high attack complexity (AC:H). Limiting factors: the target must be running Chrome for Android below 151.0.7922.72, a prior renderer-compromise primitive must exist, and the victim must load the malicious page - so realistic risk is well below what the 7.5 base score alone suggests. The description's 'compromised renderer' precondition contradicts the vector's PR:N, so treat PR:N with caution. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.5) reports high confidentiality, integrity, and availability impact but high attack complexity and required user interaction, which tempers real-world exploitability. Critically, the vector's PR:N conflicts with the description's stated precondition of an already-compromised renderer process - this is a chained, second-stage bug, not a standalone remote flaw, so treating PR:N as 'no prerequisites' would overstate accessibility; verify with vendor scoping. Chromium itself rates the security severity only Medium. There is no EPSS score, KEV listing, SSVC decision, or POC in the provided data, and no evidence of active exploitation, so priority should be driven by Chrome's ubiquity and the routine cadence of Chrome patching rather than by imminent threat. Overall: real but moderate priority - patch on normal browser-update timelines unless renderer-compromise chains are a specific concern. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level bug to gain code execution inside Chrome's sandboxed renderer on an Android device, then serves or navigates the victim to a crafted HTML page that abuses the Speech component's weak policy enforcement to escalate privileges beyond the sandbox. The high attack complexity and required user interaction (loading the malicious page) mean this is a targeted, chained attack rather than a mass-exploitable one; no public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Privilege escalation in Google Chrome on Android before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process escape further via insufficient policy enforcement in the Speech component and a crafted HTML page. Rated Medium by Chromium but scored CVSS 7.5, it enables a second-stage sandbox/privilege boundary bypass rather than initial access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: update Google Chrome on Android to version 151.0.7922.72 or later, which is delivered through the Chrome Stable channel and Google Play; see the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because Chrome auto-updates, ensure the app is not blocked from updating and force-restart the browser after update to apply it. No standalone workaround is documented; as a compensating control until updated, avoid opening untrusted web pages and consider using enterprise policy to restrict Speech/Web Speech API usage where manageable, accepting that this degrades legitimate speech-input and text-to-speech functionality. Since exploitation requires a pre-compromised renderer, keeping the browser fully patched against renderer RCE bugs is the most effective layered mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Speech subsystem (Web Speech API / speech recognition and synthesis handling) on the Android platform. CWE-269 (Improper Privilege Management) indicates the component fails to correctly enforce policy boundaries between the sandboxed renderer and higher-privileged browser components, so a renderer that is already under attacker control can drive Speech functionality to gain privileges it should not have. The affected code is identified by cpe:2.3:a:google:chrome, but the description explicitly scopes impact to the Android build of Chrome, where the renderer sandbox and IPC surface differ from desktop.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Requires a pre-compromised renderer (foothold), so PR:L not PR:N; AC:H and UI:R for the chained crafted-page step; full C/I/A impact from sandbox privilege escalation.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on Android before version 151.0.7922.72 contains a privilege escalation vulnerability that amplifies the impact of browser compromises by allowing attackers deeper access to affected devices. This vulnerability affects organizations with Android users and requires urgent patching, as it enables attackers who have compromised a user's browser to escape browser protections and access protected system resources. No public exploit has been identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB