EUVD-2026-34687
GHSA-qf3m-3w2w-q7r8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Same-origin policy bypass in the PreviewTab component of Google Chrome for Android (versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin isolation and corrupt content integrity. Exploitation requires social engineering - the victim must visit a crafted HTML page and be manipulated into performing specific UI gestures within the PreviewTab interface. The CVSS vector scores high integrity impact (I:H) with no confidentiality or availability impact, indicating an attacker can alter or inject content across origin boundaries but cannot directly exfiltrate data. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.02% (4th percentile), reflecting very low current exploitation probability.
Technical ContextAI
The affected component is PreviewTab, a Chrome for Android UI feature that allows users to preview linked pages before fully navigating. The root cause is classified under CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce same-origin policy (SOP) checks within this feature's policy enforcement layer. SOP is the foundational browser security boundary that prevents scripts on one origin from accessing or modifying resources belonging to a different origin. When PreviewTab insufficiently validates origin context - for instance, failing to isolate the preview's browsing context from the initiating page's origin - a crafted HTML page can exploit the gap to influence cross-origin content. This class of bug is Android-specific, tied to the mobile Chrome UI surface rather than the shared Chromium rendering engine core. The fix is confirmed available in Chrome 149.0.7827.53 for Android per the vendor's stable channel release advisory.
RemediationAI
The primary fix is to update Google Chrome for Android to version 149.0.7827.53 or later, which is confirmed available via the vendor's stable channel release. Users should apply this update through the Google Play Store. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides confirmation of the fix. No patch is required for desktop Chrome platforms as this vulnerability is Android-specific. If immediate patching is not feasible, a practical compensating control is to disable or avoid using the PreviewTab feature through Chrome flags (chrome://flags), which removes the vulnerable UI surface entirely; this may degrade link preview functionality but eliminates the attack vector. Restricting access to untrusted or unknown URLs through enterprise mobile device management (MDM) policy can also reduce exposure for managed Android fleets.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Medium| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today