EUVD-2026-50640
GHSA-rcmx-xmvv-cxmh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure victim to attacker-controlled page
-
DeliveryExploit separate renderer vulnerability
-
ExploitGain code execution in sandboxed renderer
-
InstallTrigger ANGLE use-after-free via crafted HTML
-
C2Corrupt freed graphics memory
-
ExecuteEscape Chrome renderer sandbox
-
ImpactExecute code at Android app layer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires two concurrent prerequisites: (1) the victim must be running Google Chrome for Android prior to 151.0.7922.72, and (2) the attacker must have already achieved code execution within the Chrome renderer process via a separate, independent vulnerability - this CVE alone does not grant renderer access. User interaction is required: the victim must navigate to or load a crafted HTML page that triggers the ANGLE memory corruption. Exploitation is therefore limited by the requirement for a chained renderer compromise, user interaction, and the Android platform scope - Chrome on Windows, macOS, Linux, or iOS is not affected by this specific issue. |
| Impact | The official CVSS 3.1 score of 5.8 (Medium) with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L accurately reflects the dual constraint of needing user interaction (UI:R) and a pre-existing renderer compromise (AC:H). The scope change (S:C) elevates the theoretical ceiling, but AC:H substantially reduces realistic exploitability. EPSS at 0.18% (8th percentile) corroborates low current exploitation interest. SSVC reports Exploitation: none, Automatable: no, Technical Impact: partial - consistent with a vulnerability that requires a chained exploit and does not lend itself to mass automated campaigns. This is not in CISA KEV. The net assessment is that this vulnerability is a meaningful component of a multi-stage exploit chain targeting Android Chrome users but does not represent a standalone high-priority emergency; its priority is elevated only in environments where renderer-level exploits are already a known threat. |
| Exploit ScenarioDerived | An attacker would first need to exploit a separate renderer-level vulnerability in Chrome for Android - for example, a JavaScript engine flaw - to gain code execution inside the sandboxed renderer process. With renderer access established, the attacker then triggers the ANGLE use-after-free by having the victim's browser process a specially crafted HTML page containing manipulated GPU draw calls, corrupting freed memory to redirect execution and escape the Chrome sandbox, ultimately achieving code execution at the Android application layer or beyond. No public exploit or proof-of-concept code for this specific CVE has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72 for Android. Users and administrators should update Chrome on all Android devices to version 151.0.7922.72 or later via the Google Play Store. The fix is documented in the Chrome Stable Channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Because this is a sandbox escape that requires a prior renderer compromise, organizations that cannot immediately patch should consider enabling Chrome's Site Isolation feature (already default in modern Chrome builds) to reduce renderer-level attack surface, and restrict access to untrusted web content through enterprise policy where feasible. Disabling JavaScript execution in restricted environments eliminates the attack surface entirely but is broadly incompatible with web application use.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is Google Chrome's cross-platform graphics abstraction layer responsible for translating OpenGL ES calls to native GPU APIs, including on Android. A CWE-416 Use After Free defect means that a memory region associated with a graphics object in ANGLE is freed but a dangling pointer to it persists; subsequent dereference of that pointer allows controlled writes into freed memory, a classic primitive for code execution within the renderer process. Because the CVSS vector carries S:C (scope change), successful exploitation allows the attacker to cross the renderer sandbox boundary and execute code in a more privileged context on the Android device. Affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Android, all builds prior to 151.0.7922.72.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory prior renderer compromise; S:C captures the sandbox escape; UI:R requires victim page load; impacts capped at Low given sandbox constraints post-escape.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in Google Chrome 151 Security Vulnerabilities
View all 80Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB