EUVD-2026-50926
GHSA-95m7-9wjc-gvfh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate renderer vulnerability
-
DeliveryAchieve renderer process code execution
-
ExploitServe crafted HTML page to victim
-
ExecutionTrigger USB policy bypass
-
ImpactLeak cross-origin data to attacker
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Two concrete conditions must both be met: (1) the attacker must have already achieved renderer process compromise in the victim's Chrome for Android session via a separate, unrelated vulnerability - this is a hard prerequisite stated explicitly in the CVE description; (2) the victim must interact with a crafted HTML page (UI:R), meaning the attacker must control or inject content the user loads. Exploitation is limited to Chrome on Android prior to 151.0.7922.72 and does not affect desktop Chrome. No authentication to the target system is required beyond achieving renderer access. The CVSS AC:H rating and SSVC 'Automatable: no' classification both reflect that mass automated exploitation is not feasible. |
| Impact | All available signals converge on genuinely low real-world risk. The CVSS 3.1 score of 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects high attack complexity and limited confidentiality impact. The EPSS score of 0.19% places this in the 9th percentile, indicating the vulnerability is very unlikely to see weaponized exploitation in the near term. SSVC assessment records exploitation as 'none' and technical impact as only 'partial', with the attack flagged as non-automatable. No KEV listing and no reported POC further reinforce low urgency. The critical limiting factor is the prerequisite renderer compromise: this vulnerability cannot be exploited standalone and requires a separate, more severe vulnerability to be leveraged first. The primary risk is as a data-leakage component in a multi-stage browser exploit chain targeting Android users. |
| Exploit ScenarioDerived | An attacker who has already exploited a separate Chrome renderer vulnerability (establishing code execution within the renderer sandbox) serves a crafted HTML page to the victim's Android Chrome session. The page triggers the USB policy enforcement flaw to read data across origins, leaking potentially sensitive cross-origin information back to the attacker-controlled context. No public POC has been identified, and the chained nature of the attack significantly raises the operational bar. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.
RemediationAI
Upgrade Google Chrome on Android to version 151.0.7922.72 or later, which is the vendor-confirmed fixed release per the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. On Android, updates are delivered via the Google Play Store; users and administrators managing Android fleets should ensure auto-updates are enabled or push the update via MDM. Because exploitation requires a prior renderer compromise, enterprise defenders who cannot immediately patch should treat any other unpatched Chrome renderer vulnerability as the higher-priority attack surface to address, since neutralizing the prerequisite renders this flaw unexploitable. No workarounds specific to the USB policy issue are documented, and disabling USB features in Chrome on Android is not user-configurable without third-party MDM policy controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is rooted in CWE-346 (Origin Validation Error), specifically within Chrome's USB subsystem on Android. The browser's USB policy enforcement logic failed to properly validate or enforce cross-origin boundaries, allowing data from one origin to be observed by a script running in a separate, attacker-controlled origin context. Affected product is identified via CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* on Android, affecting all versions prior to 151.0.7922.72. The Chromium security team rated this Low severity internally, consistent with the constrained exploitation conditions. The Chrome renderer process operates as a sandboxed component; this flaw only becomes exploitable if an attacker has already broken out of or subverted that sandbox via a separate vulnerability.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects mandatory renderer pre-compromise; C:L captures cross-origin data leakage only; no integrity or availability impact applies.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB