EUVD-2026-66019
GHSA-9p3f-ggwf-j5jg
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Social engineering is an explicit attack requirement, making UI:R more accurate than the provided UI:N; all other metrics follow directly from local-only vector, co-installed app complexity, and confidentiality-only impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low)
AnalysisAI
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) a malicious application must already be installed on the victim's Android device and registered as a Chrome share recipient - this requires the attacker to have previously achieved app installation through social engineering, sideloading, or a compromised distribution channel; and (2) the victim must be induced (via additional social engineering) to actively use Chrome's Sharing feature in a context where sensitive information is passed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is low despite the CVSS C:H rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor convinces an Android user to install a seemingly benign application - via phishing, fake app store listing, or direct social engineering - that secretly registers itself as a Chrome Sharing recipient. When the victim subsequently uses Chrome's native Share function (for example, sharing a page URL or document), the malicious app intercepts the intent and captures whatever sensitive data Chrome passes through the sharing mechanism, potentially including authenticated URLs, page titles, or clipboard content. … |
| Remediation | Vendor-released patch: Chrome 152.0.7977.65 for Android. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today