EUVD-2026-50650
GHSA-j83g-xpxw-hfhm
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network attack via malicious traffic requires active user engagement of the Sharing feature (UI:R), with only limited integrity impact from navigation bypass and no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Technical ContextAI
The vulnerability is rooted in CWE-20 (Improper Input Validation) within Chrome's Sharing subsystem on Android, the component responsible for surfacing Chrome content to Android's native share sheet and handling inbound share intents and associated network data. When processing externally-supplied network traffic through this path, the lack of adequate validation allows attacker-controlled input to influence Chrome's internal navigation logic, bypassing restrictions such as same-origin navigation guards or intent-based navigation controls. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions on Android prior to 151.0.7922.72, as confirmed by EUVD-2026-50650. Desktop Chrome is not specified as affected by this particular Sharing component flaw.
RemediationAI
Update Google Chrome for Android to version 151.0.7922.72 or later, as documented in the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome on Android updates automatically via the Google Play Store; administrators managing Android fleets through MDM should verify that Play Store auto-update policies are enforced and confirm installed versions reach at least 151.0.7922.72. If patching is delayed in managed environments, restricting access to the Chrome Sharing feature via Android enterprise policy (disabling the Share menu through managed browser configuration) eliminates the attack surface at the cost of losing cross-app sharing capability. Given the low severity and negligible EPSS, the patch applied through normal update cycles is the primary and sufficient remediation.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today