EUVD-2026-50824
GHSA-4v89-64wc-c622
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
DeliveryPage abuses UI input-validation gap
-
ExploitBypass same-origin restriction
-
ExecutionRead cross-origin data
-
ImpactExfiltrate leaked data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the victim to open a crafted HTML page in Google Chrome for Android on a version prior to 151.0.7922.72 - that page-visit is the concrete prerequisite (the CVSS UI:N rating understates this, since a victim must load attacker-controlled content). It is limited to the Android platform (desktop not indicated), and yields only cross-origin data disclosure (confidentiality), not code execution or modification. No authentication to the browser is needed (PR:N), and the default Android configuration is affected; the main limiting factor is enticing the user to the malicious page and the value of whatever cross-origin data is exposed in that session. |
| Impact | Signals are moderately consistent but point to a real-but-not-emergency issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) indicates network-reachable, low-complexity, unauthenticated exploitation with high confidentiality impact and no integrity/availability impact. However, the description clearly requires the victim to visit a crafted HTML page, which is effectively user interaction not reflected in the UI:N metric - a discrepancy defenders should note (CVSS says UI:N, but the described attack implies the victim must load attacker content). EPSS is low (0.18%, 8th percentile) and SSVC lists exploitation as 'none' and technical impact as 'partial', so this is not evidence of active exploitation; conversely SSVC marks it automatable=yes, meaning reliable weaponization is plausible if an exploit emerges. Net: a legitimate High-severity information-disclosure bug worth prompt patching via Chrome's auto-update, but not a drop-everything emergency in the absence of KEV listing or a public POC. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page and lures an Android Chrome user to it via a link in a message, ad, or compromised site. When the page loads, it abuses the UI input-validation gap to read or infer data belonging to another origin the victim is authenticated to, leaking cross-origin information back to the attacker. The low attack complexity and lack of required privileges make this straightforward once the victim opens the page. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data disclosure in Google Chrome for Android before 151.0.7922.72 lets a remote attacker leak data from other origins by luring a victim to a crafted HTML page that abuses insufficient input validation in the browser UI. Rated High by Chromium and CVSS 7.5 (confidentiality-only). There is no public exploit identified at time of analysis, and EPSS is low at 0.18%, though SSVC flags the attack as automatable with partial technical impact.
RemediationAI
Update Google Chrome on Android to 151.0.7922.72 or later - Vendor-released patch: 151.0.7922.72 (Patch available per vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Most Android installs update automatically through the Google Play Store, so ensure Play auto-updates are enabled and force an update via chrome://settings/help or the Play Store listing; in managed fleets, push the minimum-version policy through your MDM/EMM. Until the update lands, reduce exposure by avoiding untrusted links and enabling Enhanced Safe Browsing, which adds real-time protection against malicious pages (trade-off: sends more browsing telemetry to Google); there is no server-side toggle to disable since the flaw is in the client browser itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw resides in Chrome's Android UI layer, which fails to sufficiently validate untrusted input, corresponding to CWE-20 (Improper Input Validation). Because the browser is responsible for enforcing the same-origin policy, a validation gap in UI-handled input can let a malicious page observe or infer content belonging to a different origin, breaking cross-origin isolation. The affected component is Google's Chromium-based browser (CPE cpe:2.3:a:google:chrome), specifically the Android build, where the rendering and UI presentation of untrusted HTML is the attack surface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-delivered crafted page with low complexity and no privileges, but the victim must load the malicious page so UI:R; impact is cross-origin data leak only, hence C:H/I:N/A:N.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Articles & Coverage 1
Executive ViewAI
Google Chrome for Android contains a high-severity vulnerability (CVE-2026-17698) that exposes sensitive user data across websites through malicious pages. While no public exploit identified at time of analysis, organizations with mobile users face direct risks to privacy, trust, and compliance, requiring immediate patch deployment to version 151.0.7922.72.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB