EUVD-2026-50774
GHSA-h2gx-vw4g-334p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious HTML page
-
DeliveryDeliver link via phishing or ad network
-
ExploitAndroid Chrome user visits page
-
ExecutionTrigger insufficient Passwords policy enforcement
-
ImpactBypass discretionary access control on credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerability requires the victim to be running Google Chrome on Android (not desktop) at a version prior to 151.0.7922.72, and to actively visit or be redirected to an attacker-controlled crafted HTML page (UI:R). The attacker requires no prior authentication or privileges on the target system (PR:N). Exploitation is limited to the Android platform; desktop Chrome users are not affected by this CVE. The absence of scope change (S:U) means the impact is confined to the Chrome browser process itself. Mitigating factors include the required user interaction step and Android's application sandboxing, which may constrain what an attacker can do after bypassing the Passwords policy. |
| Impact | The CVSS 3.1 base score of 6.5 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - network-reachable, low complexity, requiring no attacker privileges, but dependent on user interaction (visiting a crafted page) with no scope change and no confidentiality or availability impact. The High integrity impact is the most significant signal, indicating the bypass can meaningfully subvert access control over saved passwords. However, real-world exploitation probability is low: EPSS at 0.18% places this in the 8th percentile, this CVE is not listed in CISA KEV, and no public POC has been identified at time of analysis. The platform restriction to Android further narrows the attack surface compared to a cross-platform flaw. Defenders should prioritize patching Android Chrome deployments where managed devices rely on Chrome's password manager, but this is not an emergency-tier priority absent evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page designed to manipulate Chrome's Passwords policy enforcement layer on Android, then distributes a link via phishing, SMS, or malicious advertisement. When a targeted Android Chrome user visits the page without upgrading past 151.0.7922.72, the access control bypass executes, potentially allowing the attacker's page to influence or observe credential access decisions made by the Passwords component. No public POC exists at time of analysis, so the precise exploitation mechanism has not been independently demonstrated. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.72 or later, which is confirmed as the vendor-released patch per the Chrome Stable Channel Update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On managed Android fleets, administrators should enforce Chrome version policy via MDM (e.g., Google Workspace endpoint management or Microsoft Intune) to push the update. As a compensating control where immediate patching is not possible, disabling Chrome's built-in password manager and redirecting users to a standalone password manager app removes the vulnerable component from the attack surface, though this disrupts autofill workflows. Restricting access to untrusted web content via URL filtering or Safe Browsing enforcement reduces exposure to crafted HTML pages required to trigger the vulnerability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-284 (Improper Access Control), specifically a failure of policy enforcement within Chrome's Passwords subsystem on the Android platform. The Passwords component manages credential storage, autofill decisions, and access gating for saved credentials; insufficient enforcement of discretionary access control policies in this layer can allow a crafted page to override or circumvent the permission model Chrome enforces around credential access. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* scoped to Android, covering all Chrome versions prior to 151.0.7922.72. The vulnerability is Android-specific and does not appear to affect desktop Chrome builds based on the advisory title referencing a 'stable channel update for desktop' that coincidentally patches this Android-affecting issue.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no privileges needed, user must visit page (UI:R); integrity impact only - no credential disclosure or service disruption described.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB