EUVD-2026-65884
GHSA-458h-5hgf-82mf
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
UI:R replaces vendor UI:N because social engineering to install the co-app is an explicit exploitation prerequisite per the description; all other vendor metrics are retained.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a co-installed app. (Chromium security severity: Medium)
AnalysisAI
Sandbox escape via a TOCTOU race condition in Google Chrome's Start component on Android prior to 152.0.7977.65 allows a local attacker to execute arbitrary code outside Chrome's sandbox. Exploitation requires a co-installed malicious application placed via social engineering, making opportunistic mass exploitation infeasible despite a CVSS base score of 8.1. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target device must be running Google Chrome on Android prior to version 152.0.7977.65; (2) a co-installed malicious application must already be present on the device - the description states this requires social engineering to achieve, making user-assisted app installation a practical prerequisite; (3) the race condition in Chrome's Start component must be timed successfully, which the AC:H metric confirms is non-trivial and may require repeated attempts. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a theoretically severe outcome - full C/I/A impact with sandbox escape - but multiple signals deflate real-world priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker socially engineers a target into installing a malicious Android application alongside Chrome. Once both are present on the device, the malicious app exploits the TOCTOU race window in Chrome's Start initialization sequence, winning the race to alter shared state or redirect execution before Chrome's sandbox is fully established, thereby achieving arbitrary code execution outside the sandbox in a higher-privilege Android context. … |
| Remediation | Update Google Chrome on Android to version 152.0.7977.65 or later, which contains the vendor-released fix as confirmed by the Chrome stable channel advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Chrome versions across your managed Android devices using your MDM platform to identify devices running versions prior to 152.0.7977.65. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today