EUVD-2026-40642
GHSA-wpvv-pvj4-745g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Network delivery with no privileges needed, user must visit crafted page (UI:R); memory disclosure yields high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Insufficient XML policy enforcement in Google Chrome on Android (prior to 150.0.7871.47) exposes process memory contents to remote attackers who can deliver a crafted HTML page. The flaw is classified under CWE-284 (Improper Access Control), allowing the browser's XML handling to bypass intended isolation boundaries and leak potentially sensitive in-process data - such as cookies, credentials, or other runtime state - to an attacker-controlled origin. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 6.5 (Medium) reflects meaningful real-world risk given the zero-authentication, high-confidentiality-impact profile.
Technical ContextAI
The vulnerability resides in Chrome's XML processing subsystem as implemented in the Blink rendering engine on the Android platform. CWE-284 (Improper Access Control) indicates that the root cause is a failure to correctly enforce the browser's security policy during XML document handling - likely a Same-Origin Policy or Content Security Policy bypass specific to the XML pipeline on Android. This class of flaw can arise when platform-specific code paths diverge from the desktop implementation, causing security-critical policy checks to be skipped or circumvented. The affected CPE scope is Google Chrome on Android, versions strictly prior to 150.0.7871.47, as reported by ENISA EUVD-2026-40642 and the Chromium issue tracker (issues.chromium.org/issues/513504934). The Chromium security team rated this Medium severity internally.
RemediationAI
The primary fix is to update Google Chrome on Android to version 150.0.7871.47 or later, which contains the vendor-released patch as documented in the Google Chrome Stable Channel Update advisory at chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Updates are delivered automatically via the Google Play Store for most users; administrators managing enterprise Android fleets should verify deployment via their EMM/MDM solution. If immediate patching is not feasible, restricting user access to untrusted web content through enterprise browser policies or URL filtering can reduce the attack surface by limiting exposure to crafted HTML pages, though this does not remediate the underlying flaw. No additional workarounds have been confirmed by the vendor for this specific issue.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today