EUVD-2026-40618
GHSA-8228-r7hv-mf77
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-process compromise prerequisite stated in the description; remaining metrics align with the confirmed network delivery, required user interaction, and high confidentiality impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data exfiltration in Google Chrome's Sharing feature on Android exposes sensitive page content to remote attackers who have already compromised the renderer process, exploitable via a crafted HTML page. All Chrome for Android builds prior to 150.0.7871.47 are affected; the fixed release is confirmed by Google's stable channel advisory. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate negligible observed exploitation pressure at time of analysis, though the high confidentiality impact and ubiquitous deployment of Chrome on Android make patching a clear priority.
Technical ContextAI
The vulnerability resides in Chrome's Sharing subsystem on Android - the component that exposes web content to Android's OS-level Intent and Share sheet infrastructure. CWE-284 (Improper Access Control) identifies the root cause: the Sharing feature fails to enforce cross-origin boundaries correctly, allowing data belonging to one web origin to be accessible when processed through the sharing pathway of a compromised renderer. Critically, this is a second-stage exploitation primitive: it presupposes that the attacker has already broken the renderer sandbox via a separate vulnerability. The affected scope is explicitly Android-only; no CPE string was provided in source data but the version boundary is Chrome for Android prior to 150.0.7871.47 per EUVD-2026-40618.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later, which is confirmed as the vendor-released patch per the stable channel advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android updates through the Google Play Store and typically auto-applies; users and administrators should verify the installed build under Chrome Settings > About Chrome and force an update if needed. If immediate patching is blocked, the most actionable compensating control is enabling Chrome's Site Isolation (chrome://flags/#enable-site-per-process on Android), which restricts renderer scope per origin and reduces the blast radius of a renderer compromise - though it does not eliminate the Sharing flaw itself and may increase memory usage noticeably on lower-end devices. Broadly restricting JavaScript on untrusted sites via content settings will reduce renderer attack surface but will break most modern web applications and is not recommended as a standing control. No workaround directly patches the Sharing implementation flaw; version 150.0.7871.47 is the only complete remediation.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today