EUVD-2026-50789
GHSA-hj3x-vvv3-2vj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconLure victim to malicious site on Android Chrome
-
DeliveryExploit first-stage renderer bug
-
ExploitServe crafted HTML to controlled renderer
-
InstallSend malformed input to GPU process
-
C2Trigger input-validation flaw (CWE-20)
-
ExecuteEscape sandbox into GPU process
-
ImpactExecute with elevated GPU-process privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to have already compromised the renderer process on an Android device running Google Chrome before 151.0.7922.72, and then deliver a crafted HTML page whose input targets the GPU component to escape the sandbox. Limiting factors: this is strictly a second-stage vulnerability that cannot be used without a working first-stage renderer exploit, it requires user interaction (UI:R - the victim must load attacker-controlled content), attack complexity is High, and impact is scoped to the Android Chrome build described. Despite the PR:N metric, this is not a no-prerequisite remote flaw - the prior renderer compromise is the gating condition. |
| Impact | Signals are mixed and point to a genuine-but-conditional priority rather than a mass-exploitation emergency. CVSS 8.3 is driven by the scope change and total confidentiality/integrity/availability impact, but AC:H reflects that exploitation is non-trivial and, per the description, requires an already-compromised renderer - so this is a chain link, not a standalone remote exploit despite the PR:N/AV:N metrics. EPSS is low (0.29%, 21st percentile) and CISA SSVC records Exploitation: none and Automatable: no, consistent with no KEV listing and no public POC; only Technical Impact (total) is elevated. The PR:N in the vector is Chromium's scoring convention and should not be read as 'no prerequisites' - the description explicitly requires prior renderer compromise, which the AC:H metric partially captures. Net: patch promptly as part of routine Chrome updates, but there is no evidence of active or automatable exploitation. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-process exploit (for example via a malicious ad or compromised site the victim visits), then serves a crafted HTML page whose payload sends malformed input from the controlled renderer to the GPU process, escaping the sandbox to run with GPU-process privileges. The attack requires the victim to load attacker content (UI:R) and is non-trivial to chain (AC:H). No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox through crafted input to the GPU component. This is a second-stage vulnerability (CWE-20, improper input validation) that Google rates High severity and CVSS 8.3 with a scope change; it is chained after an initial renderer bug rather than exploited alone. No public exploit has been identified at time of analysis, EPSS is low (0.29%, 21st percentile), and CISA SSVC records exploitation as none, though technical impact is rated total.
RemediationAI
Vendor-released patch: 151.0.7922.72 - update Google Chrome for Android to 151.0.7922.72 or later via the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this typically arrives through Google Play, so ensure automatic app updates are enabled and force-update managed fleets via MDM. No standalone workaround neutralizes the GPU-process flaw itself, but because exploitation requires a prior renderer compromise, defenders can raise the bar by keeping the whole browser current so the first-stage renderer bug needed to reach this code is also closed, and by using enterprise policies to restrict untrusted browsing; note that disabling GPU acceleration is not a documented or supported mitigation here and may degrade rendering without reliably preventing the flaw. Verify the running version at chrome://version after updating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw lives in Chrome's GPU process, which handles graphics/compositing work passed from the sandboxed renderer via Chromium's IPC/Mojo command interfaces. Chrome's multi-process architecture isolates web content in a low-privilege renderer sandbox; the GPU process runs at higher privilege and trusts messages it receives across the IPC boundary. The root cause is CWE-20 (improper input validation): the GPU code insufficiently validates untrusted data supplied by a compromised renderer, so maliciously crafted input crosses the trust boundary and corrupts GPU-process state. The CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* identifies the affected product generically; the description narrows real-world impact to the Android platform build. Because a successful exploit executes in the more privileged GPU process, CVSS marks a scope change (S:C).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H and UI:R capture the required prior renderer compromise plus victim loading crafted content; S:C reflects the GPU-process escape, with total C/I/A impact per Chromium's assessment.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Android before version 151.0.7922.72 contains a sandbox escape vulnerability that could enable attackers to access system resources and user data with full device privileges following renderer compromise. While no active exploitation has been identified and a patch is available, the vulnerability poses significant risk to Android device security if left unpatched. Organizations should prioritize deployment to prevent post-compromise escalation attacks on their mobile workforce.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB