EUVD-2026-50774
GHSA-h2gx-vw4g-334p
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no privileges needed, user must visit page (UI:R); integrity impact only - no credential disclosure or service disruption described.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Lifecycle Timeline
5DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability requires the victim to be running Google Chrome on Android (not desktop) at a version prior to 151.0.7922.72, and to actively visit or be redirected to an attacker-controlled crafted HTML page (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - network-reachable, low complexity, requiring no attacker privileges, but dependent on user interaction (visiting a crafted page) with no scope change and no confidentiality or availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page designed to manipulate Chrome's Passwords policy enforcement layer on Android, then distributes a link via phishing, SMS, or malicious advertisement. When a targeted Android Chrome user visits the page without upgrading past 151.0.7922.72, the access control bypass executes, potentially allowing the attacker's page to influence or observe credential access decisions made by the Passwords component. … |
| Remediation | Update Google Chrome on Android to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today