EUVD-2026-50803
GHSA-q8qc-mmgg-hvh6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage invokes malicious WebGL/graphics content
-
ExploitTrigger ANGLE implementation flaw
-
ExecutionEscape renderer sandbox
-
ImpactGain access in privileged process context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Protection mechanism completeness
|
| Exploitation Conditions | Exploitation requires the victim to load attacker-controlled content in a vulnerable Chrome for Android build (< 151.0.7922.72) that exercises the ANGLE graphics path - in practice a crafted HTML page invoking WebGL/graphics rendering, which is enabled by default. The CVSS vector confirms UI:R, so user interaction (visiting/opening the malicious page) is mandatory; no authentication is needed (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L). Limiting factors: the flaw is scoped to the Android platform per the description (desktop builds are not indicated as exploitable through this vector), it depends on the ANGLE code path being reached, and it delivers a sandbox escape rather than direct RCE, so the attacker still relies on the renderer being compromised or on chaining to achieve full device impact. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8) reflects a network-reachable, low-complexity, unauthenticated bug that requires user interaction and yields high confidentiality, integrity, and availability impact - characteristic of a drive-by browser sandbox escape. However, the real-world risk signals are more moderate: EPSS is only 0.29% (21st percentile), the CVE is NOT on the CISA KEV list, and no public proof-of-concept has been identified, suggesting the issue was fixed proactively rather than after in-the-wild abuse. Note a data conflict worth flagging: the input Tags label this 'Information Disclosure,' but the description characterizes it as a sandbox escape (which the C:H/I:H/A:H vector supports) - treat the tag as imprecise metadata, not the authoritative impact. Scope is Unchanged (S:U) in the provided vector, which is arguably conservative for a sandbox escape that crosses process trust boundaries; verify with the vendor whether scope change applies. Overall this is a legitimately high-severity browser flaw but currently a patch-in-normal-cadence priority absent evidence of active exploitation, elevated primarily for high-value or targeted mobile users. |
| Exploit ScenarioDerived | An attacker hosts or injects a crafted HTML page containing malicious WebGL/graphics content and lures an Android user to open it in a vulnerable Chrome build (e.g., via a phishing link, malvertising, or a compromised site). When the page renders, the ANGLE implementation flaw is triggered to escape the renderer sandbox, potentially giving the attacker code execution or data access in a more privileged context on the device. No public proof-of-concept has been identified at time of analysis, so this scenario is inferred from the CVSS vector and description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Sandbox escape in Google Chrome for Android (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox using a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, the flaw requires the victim to visit a malicious page (user interaction) but no authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a recently disclosed browser bug fixed before weaponization.
RemediationAI
Update Google Chrome for Android to version 151.0.7922.72 or later, which is the vendor-released patch per the Chrome Stable Channel advisory (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html); on Android this is delivered through the Google Play Store, so ensure automatic app updates are enabled and force an update on managed fleets via MDM. There is no supported configuration flag that disables ANGLE or WebGL cleanly on Android Chrome for end users, so patching is the definitive fix; as an interim compensating control for high-risk users you can restrict browsing to trusted sites and avoid untrusted links until the update propagates, accepting that this does not eliminate the risk and only reduces exposure to malicious pages. Organizations using enterprise policy can shorten the update window by mandating the minimum Chrome version through Chrome Browser Cloud Management or MDM compliance rules.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ANGLE (Almost Native Graphics Layer Engine) is the translation layer Chromium uses to convert OpenGL ES / WebGL calls from web content into the native graphics API of the host platform (on Android, typically Vulkan or OpenGL ES via the GPU driver). Because WebGL exposes GPU functionality to untrusted JavaScript, ANGLE runs as a critical trust boundary between the sandboxed renderer and the more privileged GPU process. The CWE-693 (Protection Mechanism Failure) classification indicates the root cause is not a classic memory-corruption primitive but rather an incorrect or incomplete enforcement of an intended security control - here, the sandbox isolation itself - meaning crafted graphics operations bypass a barrier that was supposed to contain them. The affected CPE is cpe:2.3:a:google:chrome, though the description explicitly scopes the exploitable condition to the Android build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered crafted page with no auth (PR:N) but mandatory user interaction (UI:R); sandbox escape yields high C/I/A, though S:U is retained per the provided vector.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
Executive ViewAI
Google Chrome for Android versions prior to 151.0.7922.72 contain a high-severity sandbox escape vulnerability that allows remote code execution when users visit a malicious webpage. Organizations with Android device deployments face direct risk of endpoint compromise affecting both employee and customer-owned devices. Immediate patching is critical to prevent exploitation of this capability, which could enable theft of credentials, data, and device control.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-693 – Protection Mechanism Failure
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB