EUVD-2026-50920
GHSA-wcgf-qqgq-hxjq
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered via crafted HTML with mandatory user page visit; integrity-only impact limited to navigation bypass, no confidentiality or availability consequence, scope unchanged within browser sandbox.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) originates from an inappropriate implementation in the browser's Media component, permitting a remote attacker to circumvent built-in navigation controls by delivering a crafted HTML page to a victim. The CVSS 4.3 score reflects a limited integrity-only impact - no code execution, no data exfiltration - and user interaction is required per the vector (UI:R). EPSS at 0.18% (8th percentile) and the absence of any KEV listing or public exploit indicate low real-world exploitation probability; Chromium's own internal severity rating of 'Low' is consistent with this assessment.
Technical ContextAI
The vulnerability resides in the Media subsystem of Google Chrome running on Android, classified under CWE-284 (Improper Access Control). Chrome's Media component encompasses media playback APIs, HTMLMediaElement behavior, media event dispatch, and Android-specific integration layers such as Android MediaPlayer or WebView media handling. An 'inappropriate implementation' in this context indicates that media-related browser APIs or media element event handlers failed to properly enforce navigation restriction policies - likely allowing crafted media events or media-session interactions to trigger or bypass same-origin or cross-origin navigation guards that should otherwise block certain URL navigations. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers Chrome broadly, but the vulnerability description explicitly scopes the issue to the Android platform, suggesting the defect involves Android-specific code paths not present in the desktop Chromium build.
RemediationAI
The vendor-released patch is Google Chrome for Android version 151.0.7922.72, documented in the stable channel update at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Android users should update Chrome via the Google Play Store immediately or verify that automatic updates are enabled. There is no configuration toggle or feature flag to disable the vulnerable Media component behavior without losing core browser functionality, so patching is the only reliable remediation. As a compensating control while awaiting device update propagation, administrators managing enterprise Android fleets via MDM can consider restricting Chrome to known-safe URL allowlists or enforcing URL filtering policies to prevent users from reaching attacker-controlled pages, though this has significant usability trade-offs. Blocking arbitrary web browsing is not practical for general users and should not be considered a substitute for patching.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today