EUVD-2026-50926
GHSA-95m7-9wjc-gvfh
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; C:L captures cross-origin data leakage only; no integrity or availability impact applies.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
Technical ContextAI
The vulnerability is rooted in CWE-346 (Origin Validation Error), specifically within Chrome's USB subsystem on Android. The browser's USB policy enforcement logic failed to properly validate or enforce cross-origin boundaries, allowing data from one origin to be observed by a script running in a separate, attacker-controlled origin context. Affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Android, affecting all versions prior to 151.0.7922.72. The Chromium security team rated this Low severity internally, consistent with the constrained exploitation conditions. The Chrome renderer process operates as a sandboxed component; this flaw only becomes exploitable if an attacker has already broken out of or subverted that sandbox via a separate vulnerability.
RemediationAI
Upgrade Google Chrome on Android to version 151.0.7922.72 or later, which is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On Android, updates are delivered via the Google Play Store; users and administrators managing Android fleets should ensure auto-updates are enabled or push the update via MDM. Because exploitation requires a prior renderer compromise, enterprise defenders who cannot immediately patch should treat any other unpatched Chrome renderer vulnerability as the higher-priority attack surface to address, since neutralizing the prerequisite renders this flaw unexploitable. No workarounds specific to the USB policy issue are documented, and disabling USB features in Chrome on Android is not user-configurable without third-party MDM policy controls.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today