EUVD-2026-50615
GHSA-xqvm-prp8-cc3x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure Android Chrome user to attacker-controlled page
-
DeliveryExploit separate renderer RCE to gain renderer code execution
-
ExploitDeliver crafted HTML triggering Tab type confusion
-
ExecutionCorrupt memory across sandbox boundary
-
PersistEscape Chrome renderer sandbox
-
ImpactExecute code with privileges outside sandbox
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Type safety enforcement
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two chained conditions: (1) the attacker must have already compromised the Chrome renderer process on the target Android device via a separate vulnerability - this is explicitly stated in the CVE description ('remote attacker who had compromised the renderer process'); and (2) the victim must interact with a crafted HTML page (UI:R), meaning the victim must actively visit attacker-controlled content. Exploitation is limited to Google Chrome running on Android; no other platforms are indicated as affected. High attack complexity (AC:H) reflects the renderer pre-compromise prerequisite. Limiting factors for defenders: the renderer compromise prerequisite significantly raises the attack bar, making this impractical as a standalone exploit; it is only meaningful as part of a multi-stage exploit chain. Exploitation is not achievable against default Chrome on Android without first achieving renderer access through a separate, independent vulnerability. |
| Impact | The CVSS 5.8 score with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L reflects the chained nature of this vulnerability: while network-delivered and unauthenticated from the initial access perspective, the high attack complexity (AC:H) captures the prerequisite that the renderer process must already be compromised via a separate exploit. EPSS at 0.20% (10th percentile) corroborates this - chained sandbox escapes are typically observed in targeted, sophisticated campaigns rather than broad exploitation. There is no CISA KEV listing and no public POC identified at time of analysis. The scope change (S:C) is the most significant risk signal: successful exploitation breaks Chrome's core security boundary, meaning impact extends beyond the sandboxed renderer. Despite the moderate CVSS base score, this vulnerability is high-value in a weaponized exploit chain targeting Android Chrome users, particularly when paired with a renderer RCE. The limited C:L/I:L/A:L impact metrics may understate post-escape impact if the device-level permissions are broad. |
| Exploit ScenarioDerived | An attacker first exploits a separate renderer-level vulnerability to achieve code execution within Chrome's sandboxed renderer process on an Android device - for example, via a memory corruption bug in a media parser or JavaScript engine. With renderer control established, the attacker delivers a crafted HTML page that triggers the type confusion in the Tab component, corrupting memory across the sandbox boundary to escape Chrome's security sandbox and execute code at a higher privilege level outside the renderer. No public proof-of-concept exploit for this specific vulnerability has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
RemediationAI
Update Google Chrome for Android to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. Users should ensure auto-update is enabled or manually update via the Google Play Store. The official release advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the upstream Chromium issue is tracked at https://issues.chromium.org/issues/520525732. As a compensating control where immediate patching is not possible, restricting navigation to untrusted or user-supplied URLs reduces exposure to the crafted HTML delivery vector, though this does not address the underlying flaw. Enterprise deployments using Chrome management policies can enforce minimum version requirements via Chrome Browser Cloud Management.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-843 (Type Confusion) occurs when code accesses a memory object as an incompatible type, producing undefined behavior and potential memory corruption. In Chrome's multi-process architecture, the renderer process is sandboxed from the OS and other Chrome processes - type confusion in the Tab component can corrupt internal state in a way that violates sandbox boundaries, allowing attacker-controlled code to escape to a more privileged execution context. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* with Android as the target platform, specifically all Chrome versions below 151.0.7922.72. The CVSS S:C (Scope Changed) flag confirms that successful exploitation crosses security boundaries beyond the initially vulnerable component.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Renderer pre-compromise captured by AC:H; unauthenticated network delivery via crafted page; scope change confirmed by sandbox escape; limited C/I/A reflects constrained post-escape impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB