EUVD-2026-50687
GHSA-6x6h-w33h-j95f
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Sandbox escape implies S:C (changed scope from renderer to browser process); all other metrics align with the published vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Use-after-free in the Bluetooth component of Google Chrome on Android prior to 151.0.7922.72 enables a sandbox escape for remote attackers who have already achieved renderer process compromise. Exploitation requires delivering a crafted HTML page to a victim user and successfully triggering a memory corruption condition in the Bluetooth subsystem, allowing code execution outside the renderer sandbox. No public exploit code has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low observed exploitation probability; no CISA KEV listing is present.
Technical ContextAI
CWE-416 (Use After Free) describes a class of memory corruption flaws where code continues to dereference a pointer after the underlying memory object has been freed, potentially allowing an attacker to control execution flow by populating the freed region with attacker-controlled data before the dangling pointer is used. Here, the vulnerable subsystem is Chrome's Bluetooth stack running within the Android browser process. The CPE entry cpe:2.3:a:google:chrome is broad, but the EUVD affected-version range and the CVE description both constrain the issue to Chrome on Android specifically. Because the Bluetooth component resides in the browser (privileged) process and is reachable from the renderer via IPC, a compromised renderer can send crafted inter-process messages to trigger the UAF in the higher-privilege context - the canonical mechanism for renderer-to-browser sandbox escapes in Chromium's architecture. The Chromium security severity is rated Medium, consistent with the chained-exploitation prerequisite.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later; this is the vendor-released patch confirmed by the stable-channel advisory at chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at issues.chromium.org/issues/498000415. Chrome on Android updates via the Google Play Store and may be configured for automatic updates. As a compensating control prior to patching, organizations may consider disabling Bluetooth functionality at the OS level on managed Android devices, which would remove the vulnerable subsystem from the attack surface; note that this disables all Bluetooth-dependent device functionality (audio, peripherals, etc.). Because exploitation requires a compromised renderer as a prerequisite, maintaining up-to-date Chrome builds to close any co-exploitable renderer vulnerabilities is an effective risk reduction strategy independent of this specific fix.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today