EUVD-2026-50802
GHSA-w4xq-p7f5-g2wm
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Crafted page delivered over the network (AV:N) with victim page-load (UI:R); the sandbox escape yields a scope change (S:C) with full host impact; PR:N is retained per official scoring though a prior renderer compromise is required in practice.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker has ALREADY compromised the Chrome renderer process (as the description states) and then serves a crafted HTML page that exercises the vulnerable ANGLE code path to escape the sandbox; it also requires user interaction (UI:R), since the victim must load the attacker-controlled page, and applies specifically to Google Chrome on Android below 151.0.7922.72. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals must be read together and they conflict. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker first achieves code execution in Chrome's renderer (for example via a separate memory-corruption bug), then lures the victim to a crafted HTML page that drives malicious WebGL/graphics calls into ANGLE to escape the renderer sandbox and gain broader access on the Android device. No public exploit is identified at time of analysis, and the attack depends on chaining with a prior renderer compromise plus the victim opening attacker-controlled content, reflecting the network vector, low complexity, and required user interaction in the CVSS data. |
| Remediation | Vendor-released patch: update Google Chrome on Android to 151.0.7922.72 or later per the Chrome Releases advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this ships through Google Play, so ensure automatic app updates are enabled and force updates on managed fleets via MDM. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Chrome versions across Android devices in your organization using MDM or mobile security scanning to identify exposure to versions prior to 151.0.7922.72. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today