EUVD-2026-50621
GHSA-3p38-7q3j-hw9h
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Local vector confirmed by description; PR:N because no device credentials needed, only local presence; S:C reflects sandbox escape crossing security boundary; UI:R for required user interaction with crafted HTML.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
4DescriptionCVE.org
Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have local access to the target Android device (AV:L) - remote network exploitation is not possible with this vulnerability as described. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world exploitation risk is substantially lower than the 6.1 CVSS Medium score alone might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with physical or local access to an Android device delivers a crafted HTML page to the victim - for example via a shared local file, a local network resource, or a social engineering link opened on the device. When the user opens the page in Chrome, the malicious HTML triggers the cryptographic flaw in the WebAppInstalls component. … |
| Remediation | Update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store; this is the vendor-confirmed patched release per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today