EUVD-2026-40615
GHSA-9q58-8m4g-h5mx
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Local file delivery mandates physical or existing device access (AV:L); victim must open the malicious file (UI:R); no prior privileges required (PR:N); only navigation integrity is impacted (I:H), with no confidentiality or availability effect.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.
Technical ContextAI
The vulnerability originates in DevTools, Chrome's built-in developer tooling layer, specifically its implementation on Android. CWE-20 (Improper Input Validation) as the root cause class indicates that DevTools fails to adequately validate or sanitize inputs encountered when processing certain file types, causing navigation policy enforcement logic to be bypassed. On Android, Chrome DevTools can interact with local file system resources and exposes debugging surfaces that interact with browser navigation controls; the policy enforcement gap here allows a specially crafted file to manipulate navigation state in ways the policy layer was designed to block. Affected CPE aligns with Chrome for Android prior to 150.0.7871.47 as confirmed by the EUVD affected-version range.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store or Chrome's built-in update mechanism; this is the vendor-confirmed fix per the stable channel release advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. No official workaround is documented. As a compensating control prior to patching in managed enterprise environments, administrators can restrict DevTools access on Android via Chrome enterprise policy (e.g., disabling remote debugging or restricting file access permissions), which reduces the attack surface but may impair developer workflows. Given the local attack vector and low EPSS, prioritize this patch within the normal monthly patching cycle rather than as an out-of-band emergency update.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today