Description
Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Published: 2026-08-06
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from inadequate validation of untrusted input within Chrome WebAPKs on Android. A locally present attacker could use a specially crafted file to escape the sandbox, potentially compromising the device. The flaw is a classic input validation issue, classified as CWE-20 and CWE-1286.

Affected Systems

This issue affects Google Chrome on Android versions prior to 151.0.7922.109. The known affected product is Google:Chrome.

Risk and Exploitability

Chromium rates the incident as high severity, with a CVSS score of 8.6. The exploitation requires local file access, so it is not remotely exploitable; any user who can place a malicious file on the device can trigger the exploit. The EPSS score is <1%, indicating a low probability of exploitation, and it is not listed in the CISA KEV catalog. The exploitation path involves creating a malicious file and launching Chrome to process it.

Generated by OpenCVE AI on August 13, 2026 at 13:29 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 151.0.7922.109 or later, which includes the input validation fix.
  • If an upgrade is not immediately possible, disable WebAPK support or use a file system sandbox to prevent the creation or opening of malicious files by local users.
  • Apply Android device‑policy controls that restrict arbitrary file creation and require user consent before granting file access to Chrome.

Generated by OpenCVE AI on August 13, 2026 at 13:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4728-1 chromium security update
Debian DSA Debian DSA DSA-6422-1 chromium security update
History

Thu, 13 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: Google Chrome on Android: Sandbox escape via malicious WebAPK input
Weaknesses CWE-1286
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 07 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
Title Local Sandbox Escape via Malicious File in Chrome WebAPKs on Android

Fri, 07 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 07 Aug 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Fri, 07 Aug 2026 00:30:00 +0000

Type Values Removed Values Added
Title Local Sandbox Escape via Malicious File in Chrome WebAPKs on Android

Thu, 06 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-08T03:55:19.661Z

Reserved: 2026-08-06T16:51:45.590Z

Link: CVE-2026-19143

cve-icon Vulnrichment

Updated: 2026-08-07T12:47:14.863Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-06T22:16:56.423

Modified: 2026-08-08T05:17:07.347

Link: CVE-2026-19143

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-06T20:33:44Z

Links: CVE-2026-19143 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T13:30:17Z

Weaknesses
  • CWE-1286

    Improper Validation of Syntactic Correctness of Input

  • CWE-20

    Improper Input Validation