EUVD-2026-50906
GHSA-hc7x-r5qj-59qm
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page (AV:N), but specific gesture elicitation makes exploitation non-trivial (AC:H, UI:R); impact is confidentiality-only and partial (C:L), with no scope change.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.
Technical ContextAI
The root cause is classified under CWE-451 (User Interface Misrepresentation of Critical Information), a class of flaw where the browser's UI layer fails to correctly enforce or visually distinguish cross-origin boundaries, potentially exposing data that should be isolated by the same-origin policy. In Chrome on Android specifically, this manifests in the UI rendering subsystem - likely involving gesture-driven interactions that trigger a code path where cross-origin content or state becomes observable to a malicious page. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, scoped to Android, with EUVD confirming the affected range as all versions below 151.0.7922.72. CWE-451 vulnerabilities in browsers often involve overlay attacks, scroll-jacking, or gesture interception that blurs the visual or behavioral boundary between origins.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store or Chrome's built-in update mechanism; the stable channel release note is at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, organizations should advise users to avoid interacting with unfamiliar or unsolicited web pages that prompt them to perform UI gestures such as scrolling, swiping, or tapping in specific sequences, since the exploit chain depends entirely on user compliance with attacker-directed gestures. No meaningful technical workaround exists at the network perimeter level given the attack is delivered over standard HTTPS.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today