EUVD-2026-50621
GHSA-3p38-7q3j-hw9h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local Android device access
-
DeliveryCraft malicious HTML page targeting WebAppInstalls
-
ExploitInduce user to open page in Chrome
-
ExecutionTrigger cryptographic flaw in PWA install flow
-
PersistEscape Chrome renderer sandbox
-
ImpactAccess resources beyond browser sandbox boundary
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires the attacker to have local access to the target Android device (AV:L) - remote network exploitation is not possible with this vulnerability as described. The victim must interact with a crafted HTML page (UI:R), making this dependent on a social engineering or local file delivery step. The vulnerability is specific to the WebAppInstalls component, meaning the exploit path involves HTML content that triggers PWA installation processing in Chrome on Android. No elevated device privileges are required of the attacker (PR:N), meaning any local user or co-located person can attempt exploitation without root or admin access. Exploitation is limited to Android; Chrome on other platforms is not listed as affected. The non-default condition of the user actively opening a crafted page limits opportunistic automated exploitation. |
| Impact | Real-world exploitation risk is substantially lower than the 6.1 CVSS Medium score alone might suggest. The local attack vector (AV:L) is the primary limiting factor: an attacker must have some form of local access to the Android device, ruling out purely remote mass exploitation. User interaction (UI:R) introduces a further dependency - the victim must open a crafted HTML page. EPSS at 0.12% (2nd percentile) aligns with these constraints, placing this vulnerability well below active exploitation thresholds. There is no CISA KEV listing and no confirmed public exploit code. Offsetting these mitigators, the scope change (S:C) and the reported capability of privilege escalation via sandbox escape are genuinely impactful if triggered. The combination of local-only access, required user interaction, and very low EPSS indicates this is a real but low-priority issue except for high-risk individuals (targeted attacks, high-value mobile users). The CVSS vector's PR:N is notable - no device privileges are required beyond local presence, slightly elevating practical exploitability over a PR:L scenario. |
| Exploit ScenarioDerived | An attacker with physical or local access to an Android device delivers a crafted HTML page to the victim - for example via a shared local file, a local network resource, or a social engineering link opened on the device. When the user opens the page in Chrome, the malicious HTML triggers the cryptographic flaw in the WebAppInstalls component. The exploit escapes the Chrome renderer sandbox, gaining elevated access to Android process resources beyond the browser's normal confinement. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store; this is the vendor-confirmed patched release per the Chrome Stable Channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate update is not possible, a practical compensating control is to avoid opening untrusted HTML pages or installing PWAs from unverified sources, which removes the UI:R trigger condition; this limits functionality but reduces exposure. Disabling PWA installation (if manageable via enterprise policy through Chrome browser cloud management) would remove the WebAppInstalls attack surface entirely, though this eliminates PWA support. There is no indication that network-level controls would mitigate this vulnerability given the local attack vector.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebAppInstalls is the Chrome subsystem responsible for Progressive Web App (PWA) installation workflows on Android, handling HTML parsing, manifest processing, and associated cryptographic operations. A flaw in cryptographic logic within this component - CWE not formally assigned in available data - allows a crafted HTML page to produce an unexpected security-boundary crossing. The CVSS S:C (Scope Changed) metric confirms the exploit escapes the Chromium renderer sandbox and gains influence over the broader Android process space. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* narrowed by EUVD to all Chrome versions below 151.0.7922.72. Because CWE is listed as N/A, the precise cryptographic weakness class (e.g., broken algorithm, incorrect key handling, nonce reuse) cannot be confirmed from available data.
Know when Jwt Attack gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Local vector confirmed by description; PR:N because no device credentials needed, only local presence; S:C reflects sandbox escape crossing security boundary; UI:R for required user interaction with crafted HTML.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in WSO2 API Manager and related components (Universal Gateway, Traffic Manager, API Control Plane,
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
Security feature bypass in Microsoft .NET (shipped via Visual Studio 2022 17.12/17.14 and Visual Studio 2026 18.7) lets
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
Authentication and authorization bypass in fast-jwt 6.2.0 through 6.2.4 (npm, NearForm) lets a remote, unauthenticated a
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB