What is the CVSS score of EUVD-2026-54115?

EUVD-2026-54115 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome Android are affected by EUVD-2026-54115?

Google Chrome on Android versions prior to 151.0.7922.109 contain a sandbox escape vulnerability (CVSS 8.6) that allows local attackers to break out of Chrome's security isolation and access…. A patch is available.

How to fix or mitigate EUVD-2026-54115?

Within 24 hours, query mobile device management systems to identify all Android devices running Chrome prior to version 151.0.7922.109 and flag for immediate remediation. Within 7 days, deploy Chrome 151.0.7922.109 or later through your MDM platform; for unmanaged devices, issue urgent notification requiring manual update from Google Play Store. Within 30 days, confirm patch coverage reaches 95% or higher through MDM reporting and establish a policy to deploy Chrome security updates within two weeks of release.

Chrome Android EUVD-2026-54115

| CVE-2026-19143 HIGH

Improper Input Validation (CWE-20)

2026-08-06 chrome-cve-admin@google.com

GHSA-ff4p-927c-7922

Information Disclosure Google Red Hat Suse

8.6

CVSS 3.1 · Vendor: google

Severity by source

Vendor (google) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.6 HIGH

Local delivery of malicious file with required user interaction; sandbox escape creates scope change justifying S:C and full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

CRITICAL

qualitative

Red Hat

8.2 HIGH

qualitative

Primary rating from Vendor (google).

CVSS VectorVendor: google

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 13:23 vuln.today

CVSS changed

Aug 07, 2026 - 13:22 NVD

8.6 (HIGH)

CVE Published

Aug 06, 2026 - 22:16 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 06, 2026 - 22:16 cve.org

HIGH 8.6

DescriptionCVE.org

Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

AnalysisAI

Sandbox escape in Google Chrome on Android prior to 151.0.7922.109 is achievable by a local attacker via a malicious file exploiting insufficient input validation in WebAPK processing. The CVSS scope change (S:C) with high confidentiality, integrity, and availability impacts reflects the potential for full breakout beyond Chrome's sandbox boundary into the broader Android process space. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available in the stable channel release.

Technical ContextAI

WebAPKs (Web Android Packages) are APK files generated by Chrome when a user installs a Progressive Web App (PWA) on Android, granting the PWA a native-app identity and tighter OS integration than a standard browser shortcut. Chrome's sandbox on Android isolates browser renderer processes from the host OS using Android's process isolation primitives; a sandbox escape allows code execution outside that containment boundary. The root cause is CWE-20 (Improper Input Validation) - Chrome fails to adequately validate untrusted data supplied via a WebAPK-related file, allowing attacker-controlled input to influence execution in a privileged context. The affected CPE scope is Chrome on Android only; desktop Chrome is not referenced in the advisory or EUVD affected-version data.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.109 or later, available via the Google Play Store or Chrome's built-in update mechanism. The vendor patch is confirmed available per the stable channel advisory at chromereleases.googleblog.com (August 2026 stable channel update). Users and enterprise MDM administrators should verify auto-update policies are active for managed Android devices. If immediate patching is not possible, restricting installation or interaction with untrusted WebAPK files and disabling PWA installation for unmanaged users are partial compensating controls, though these carry usability trade-offs for organizations relying on PWA deployments. No alternative workaround is specified in the available advisory data.