EUVD-2026-50615
GHSA-xqvm-prp8-cc3x
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Renderer pre-compromise captured by AC:H; unauthenticated network delivery via crafted page; scope change confirmed by sandbox escape; limited C/I/A reflects constrained post-escape impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
5DescriptionCVE.org
Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two chained conditions: (1) the attacker must have already compromised the Chrome renderer process on the target Android device via a separate vulnerability - this is explicitly stated in the CVE description ('remote attacker who had compromised the renderer process'); and (2) the victim must interact with a crafted HTML page (UI:R), meaning the victim must actively visit attacker-controlled content. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.8 score with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L reflects the chained nature of this vulnerability: while network-delivered and unauthenticated from the initial access perspective, the high attack complexity (AC:H) captures the prerequisite that the renderer process must already be compromised via a separate exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first exploits a separate renderer-level vulnerability to achieve code execution within Chrome's sandboxed renderer process on an Android device - for example, via a memory corruption bug in a media parser or JavaScript engine. With renderer control established, the attacker delivers a crafted HTML page that triggers the type confusion in the Tab component, corrupting memory across the sandbox boundary to escape Chrome's security sandbox and execute code at a higher privilege level outside the renderer. … |
| Remediation | Update Google Chrome for Android to version 151.0.7922.72 or later, which contains the vendor-released patch for this issue. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Memory Corruption
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today