EUVD-2026-40652
GHSA-8vph-c3qm-569r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network delivery via crafted page (AV:N), no authentication needed (PR:N), user must load page (UI:R); only integrity is impacted through navigation bypass (I:H, C:N, A:N).
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Navigation restriction bypass in Google Chrome's WebView component on Android (all versions prior to 150.0.7871.47) allows remote unauthenticated attackers to circumvent enforcement of navigation policies via a specially crafted HTML page, producing high integrity impact with no confidentiality or availability consequence. The CVSS vector (PR:N, UI:R) confirms unauthenticated network exploitation gated on victim interaction, consistent with a social-engineering or malicious-redirect delivery. No public exploit exists and CISA has not added this to KEV; EPSS of 0.22% (13th percentile) and SSVC Exploitation:none collectively indicate low active exploitation probability at time of analysis.
Technical ContextAI
The vulnerability resides in the WebView navigation policy enforcement layer within Google Chrome on Android. CWE-284 (Improper Access Control) identifies the root cause class: the engine fails to correctly apply security policies governing permissible navigation targets, allowing an attacker-controlled page to direct WebView outside its intended navigational boundaries. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions prior to the fix. On Android, WebView is both the rendering engine for Chrome and a system-level component embedded in third-party apps; policy enforcement failures in this layer can therefore affect both Chrome browser users and any Android application whose embedded WebView is powered by Chrome. The Chromium security team rated this Medium severity, aligning with the constrained impact profile (integrity-only, user interaction required).
RemediationAI
Upgrade Google Chrome on Android to version 150.0.7871.47 or later, which contains the vendor-released patch per the stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome updates on Android are delivered through the Google Play Store; users should verify their installed version under Chrome Settings > About Chrome and manually trigger a Play Store update if auto-update has not yet applied. Additionally, Android System WebView - a separate Play Store component that powers WebView in third-party apps - should be updated independently, as it may share the same vulnerable policy enforcement code; enterprise MDM administrators should confirm both components are at the patched version. As a compensating control prior to patching, restrict user exposure to untrusted hyperlinks and train users to avoid following links from unknown senders, since exploitation strictly requires the victim to load a crafted HTML page (UI:R). This compensating control carries the trade-off of limiting legitimate link-following behavior but meaningfully reduces attack surface given the social-engineering delivery requirement.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today