EUVD-2026-40625
GHSA-gcx4-xh62-vw52
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
AC:H reflects mandatory renderer pre-compromise; UI:R for required user interaction; I:L for UI spoofing only; no confidentiality or availability impact applies.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's WebShare implementation on Android allows a remote attacker who has already compromised the renderer process to deceive users via a malicious HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. The exploitation path is severely constrained by the requirement for a pre-existing renderer compromise, yielding a CVSS base score of only 3.1 (Low); no public exploit code exists and SSVC assessment confirms no active exploitation at time of analysis.
Technical ContextAI
The WebShare API (navigator.share()) enables web pages to invoke Android's native OS sharing dialog, allowing content to be passed to other installed applications. CWE-20 (Improper Input Validation) indicates Chrome's WebShare implementation fails to adequately sanitize or validate untrusted data originating from a compromised renderer process before surfacing it in the native share UI. Because the renderer process is sandboxed, a renderer compromise is itself a meaningful precondition - this vulnerability extends the reach of a renderer-level attacker into the user-visible sharing surface. The affected CPE scope is Chrome for Android only; desktop Chrome is not affected per the advisory.
RemediationAI
Update Google Chrome on Android to version 150.0.7871.47 or later; this is the vendor-confirmed patched release per the Chrome stable channel update advisory at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome on Android typically auto-updates via the Google Play Store, so ensuring auto-update is enabled is sufficient for most environments. No workarounds or compensating controls are documented by the vendor. Since exploitation requires a prior renderer compromise, organizations can reduce overall risk surface by ensuring Chrome is kept current across all Chrome releases (addressing any renderer-level vulnerabilities that could serve as the initial foothold), as the WebShare flaw is not independently exploitable.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today