A flaw in Chrome for Android’s speech engine permits a remote attacker who has already subverted the renderer process to execute code with higher privileges. The vulnerability is rooted in insufficient policy enforcement (CWE‑269). By delivering a crafted HTML page, the attacker can escape the renderer’s sandbox and access data or operations normally restricted.

Google Chrome on Android devices running any version before 151.0.7922.72 are affected. All Android OS releases that ship with Chrome in the stable channel are potentially vulnerable until the July 2026 update is installed.

The CVSS score of 7.5 places this issue in the medium–high severity range, yet the EPSS score of less than 1 % indicates that exploitation is currently unlikely. It is not listed in the CISA KEV catalog, suggesting no confirmed exploitation. The attack requires the attacker to first compromise the renderer process, which typically involves a user opening a malicious web page or letting a compromised extension run code.