EUVD-2026-40622
GHSA-7mpv-wh4q-rrqw
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network-delivered via crafted page with no privileges required, but mandatory user navigation (UI:R); only confidentiality impacted as memory is read but neither modified nor crashed.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Memory disclosure in Google Chrome's Passwords component on Android prior to 150.0.7871.47 allows a remote attacker to extract potentially sensitive information from process memory. Exploitation requires luring a target user to visit a specially crafted HTML page, placing this squarely in the social-engineering-assisted drive-by category. No public exploit code has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) indicates meaningful credential exposure risk given Chrome's role as a primary password manager on Android devices.
Technical ContextAI
The vulnerability resides in the Passwords subsystem of Chromium's Android build - the component responsible for storing, retrieving, and autofilling user credentials. CWE-284 (Improper Access Control) indicates that memory containing password-related data is not sufficiently isolated from renderer-accessible code paths. An 'inappropriate implementation' in this context typically means the renderer process or a web-accessible API can read memory regions that should be guarded by the browser's process sandbox or privilege boundaries. The Android-only scope suggests the flaw may involve platform-specific IPC between the Chrome renderer and Android's credential store or a Passwords-specific JNI bridge, rather than the cross-platform Blink engine. The Chromium issue tracker reference 513044658 would contain the authoritative root cause, but was not accessible during this analysis.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later via the Google Play Store. The vendor advisory is available at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. For organizations managing Android fleets via MDM, push the Chrome update as a priority given the high confidentiality impact. As a short-term compensating control while patching is in progress, disable Chrome's built-in password manager (Chrome Settings > Passwords > Save passwords toggle) to reduce the value of any successful memory read, though this removes credential autofill and shifts risk to weaker password hygiene. Restricting user browsing to trusted domains via enterprise policy can also reduce drive-by attack surface on managed devices.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today