EUVD-2026-50879
GHSA-gjwq-f966-4wff
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page requiring one user click; no attacker privileges; navigation bypass yields high integrity loss; no data exposure or service disruption.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Technical ContextAI
WebView is a core Android system component - built on the Chromium rendering engine - that allows native applications to embed and render web content within their UI. Android developers use WebView's policy enforcement APIs (such as shouldOverrideUrlLoading and WebViewClient callbacks) to restrict which URLs or origins the embedded browser may navigate to, a pattern common in enterprise MDM apps, banking apps, and kiosk-mode interfaces. The vulnerability stems from insufficient enforcement of these navigation policies, allowing a crafted HTML page to circumvent whatever restrictions the host application or Chrome itself has imposed. No CWE has been formally assigned, but the root cause class is consistent with CWE-693 (Protection Mechanism Failure) or CWE-601 (URL Redirection to Untrusted Site or Phishing). The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome versions below the fixed release. The Chromium issue tracker entry (https://issues.chromium.org/issues/517335150) and the ENISA EUVD record (EUVD-2026-50879) corroborate the scope.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later immediately via the Google Play Store; this is the vendor-confirmed fixed release per the advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Android application developers embedding WebView should also ensure the Android System WebView package is updated to the corresponding patched build via Google Play, as WebView is delivered as a separately updatable system component. As a compensating control where immediate update is not feasible, developers should augment WebView policy enforcement with server-side URL validation and allowlist enforcement at the network layer, so that navigation restrictions are not solely dependent on the client-side WebView policy mechanism - note this approach adds server-side complexity and requires infrastructure changes. End users should verify automatic updates are enabled for both Chrome and Android System WebView in the Play Store to ensure prompt delivery of future patches.
Same technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today