EUVD-2026-50925
GHSA-cjwc-jg7v-587j
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Race conditions require precise timing exploitation, warranting AC:H over the vendor's AC:L; all other metrics align with a remote, unauthenticated, user-interaction-dependent spoofing flaw with no confidentiality or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.
Technical ContextAI
The vulnerability is rooted in CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization) within Chrome's PictureInPicture (PiP) subsystem on Android. PiP allows a video or content overlay to persist while the user navigates away, and the component must track and display the origin domain of the floating content. A race condition in how PiP resolves or updates the displayed origin during concurrent browser state transitions allows an attacker-controlled page to substitute a spoofed domain into the browser's trust display. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, with EUVD data (EUVD-2026-50925) narrowing the affected range to Chrome on Android versions below 151.0.7922.72. The Android-specific scope suggests the PiP race is tied to the Android platform's windowing model or overlay rendering pipeline, distinct from desktop implementations.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, available through the Google Play Store or Chrome's built-in update menu (Settings → About Chrome → Update). The vendor patch advisory is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. No formal vendor-confirmed workaround exists; however, organizations managing Android fleets via MDM (e.g., Google Workspace endpoint management) can enforce a minimum Chrome version policy to block vulnerable versions from accessing corporate resources, with the trade-off of potentially disrupting users who have not yet received the update. Avoiding use of PictureInPicture on untrusted sites may reduce surface exposure but cannot be enforced at scale and is not a supported mitigation.
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today