Description
Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-07-30
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Insufficient validation of untrusted input in the WebView component of Google Chrome for Android before version 151.0.7922.72 could allow a malicious HTML page to trigger a sandbox escape, enabling code execution outside the isolated WebView environment. The vulnerability is related to improper input validation and insufficient use of security functionality, corresponding to CWE‑20 and CWE‑1286.

Affected Systems

Google Chrome for Android versions earlier than 151.0.7922.72. Any Android application that embeds an older WebView instance may also be exposed.

Risk and Exploitability

The CVSS score of 7.1 indicates medium severity, and the EPSS score of less than 1 % suggests a low likelihood of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is likely remote, requiring a crafted web page that the affected WebView will load; successful exploitation would result in code execution outside the sandboxed process.

Generated by OpenCVE AI on August 3, 2026 at 12:19 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Google Chrome to version 151.0.7922.72 or later.
  • If your app embeds an older WebView, update the WebView runtime to the latest version or disable JavaScript and related features when loading untrusted content.
  • Validate and sanitize any web content before passing it to the WebView to ensure no malicious input is processed.

Generated by OpenCVE AI on August 3, 2026 at 12:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Fri, 31 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Insufficient validation of untrusted input in WebView
Weaknesses CWE-1286
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 30 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-20
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T18:44:39.508Z

Reserved: 2026-07-27T23:34:35.268Z

Link: CVE-2026-17741

cve-icon Vulnrichment

Updated: 2026-07-30T18:44:32.712Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:36.937

Modified: 2026-08-03T13:47:24.060

Link: CVE-2026-17741

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-30T00:19:08Z

Links: CVE-2026-17741 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:30:17Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-20

    Improper Input Validation