EUVD-2026-65850
GHSA-36q4-27qc-mp78
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects the mandatory renderer-compromise prerequisite; S:C and full C/I/A capture OS-level code execution outside the Chrome sandbox boundary.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in the WebView component of Google Chrome on Android (prior to version 152.0.7977.65) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox on the target device via a crafted HTML page. This CWE-610 externally controlled reference flaw represents the second stage of a chained exploit - requiring a companion renderer exploit to be viable - which substantially raises the real-world exploitation bar despite the CVSS 8.3 High score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two sequential, mandatory prerequisites: first, the attacker must have already achieved code execution within Chrome's renderer process on the target Android device via a separate, independent vulnerability - this is explicitly stated in the CVE description and is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.3 High score is driven by full C/I/A impact and a scope change (S:C) reflecting OS-level code execution outside the Chrome sandbox, but AC:H and UI:R significantly constrain real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate, unrelated Chrome renderer vulnerability to gain arbitrary code execution within the sandboxed renderer process on the victim's Android device, then delivers or causes the renderer to process a crafted HTML page that triggers the CWE-610 externally controlled reference flaw in WebView, which causes the browser or OS process to resolve an attacker-controlled reference in a higher-privilege context, achieving code execution outside the sandbox. No public exploit code for this specific vulnerability has been identified at time of analysis. |
| Remediation | Update Google Chrome on Android to version 152.0.7977.65 or later as the definitive fix, per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, use Mobile Device Management (MDM) systems to identify all Android devices running Chrome versions prior to 152.0.7977.65, and assess which devices have access to sensitive corporate data or systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today