EUVD-2026-50686
GHSA-jj5q-4r22-f559
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
AC:H reflects mandatory renderer pre-compromise; S:C captures sandbox escape crossing security boundaries; UI:R for required victim page visit; no elevated privileges needed for initial delivery.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Technical ContextAI
Chrome's multi-process architecture isolates web content in sandboxed renderer processes, which are restricted from making direct system calls or accessing OS resources outside the sandbox. On Android, WebView serves as the embedded browser engine for apps and is subject to the same sandbox model. CWE-20 (Improper Input Validation) in this context means that WebView fails to sufficiently validate untrusted data crossing from the renderer into a higher-privilege component - a classic inter-process boundary failure. This type of flaw is a second-stage primitive in a full chain: an attacker first needs code execution inside the renderer (typically via a separate memory corruption or logic bug), then leverages the validation gap to escape into the broader Android process space. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* indicates all Chrome versions before the fix are in scope, but the Android/WebView qualifier in the description limits the attack surface to the mobile platform.
RemediationAI
Upgrade Google Chrome on Android to version 151.0.7922.72 or later, which contains the vendor-released fix. The patch is documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On Android, Chrome typically updates automatically via the Google Play Store; administrators managing Android fleets via EMM/MDM solutions should verify enforcement of the minimum version. If immediate upgrade is not possible, restricting access to untrusted web content in WebView-based applications and disabling JavaScript where not required in embedded WebView instances can reduce the attack surface, though these controls may break application functionality. Given the AC:H requirement, organizations should prioritize patching alongside any concurrent renderer-level Chrome vulnerabilities that could serve as the prerequisite first-stage exploit.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today