EUVD-2026-50640
GHSA-rcmx-xmvv-cxmh
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory prior renderer compromise; S:C captures the sandbox escape; UI:R requires victim page load; impacts capped at Low given sandbox constraints post-escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
Technical ContextAI
ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform graphics abstraction layer responsible for translating OpenGL ES calls to native GPU APIs, including on Android. A CWE-416 Use After Free defect means that a memory region associated with a graphics object in ANGLE is freed but a dangling pointer to it persists; subsequent dereference of that pointer allows controlled writes into freed memory, a classic primitive for code execution within the renderer process. Because the CVSS vector carries S:C (scope change), successful exploitation allows the attacker to cross the renderer sandbox boundary and execute code in a more privileged context on the Android device. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Android, all builds prior to 151.0.7922.72.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for Android. Users and administrators should update Chrome on all Android devices to version 151.0.7922.72 or later via the Google Play Store. The fix is documented in the Chrome Stable Channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because this is a sandbox escape that requires a prior renderer compromise, organizations that cannot immediately patch should consider enabling Chrome's Site Isolation feature (already default in modern Chrome builds) to reduce renderer-level attack surface, and restrict access to untrusted web content through enterprise policy where feasible. Disabling JavaScript execution in restricted environments eliminates the attack surface entirely but is broadly incompatible with web application use.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today