Description
Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An incorrect reference resolution (CWE-706, CWE-386) flaw in the Chrome Core module on Android allows a remote attacker to obtain sensitive information by social engineering through a crafted HTML page. The vulnerability is triggered when a user visits a maliciously designed webpage, causing the browser to resolve references incorrectly and expose data that should remain private.

Affected Systems

Google Chrome on Android versions earlier than 151.0.7922.169 are affected. The flaw does not apply to other platforms or later Chrome releases.

Risk and Exploitability

The vulnerability is rated 6.5 on the CVSS, reflecting moderate severity. The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in theISA KEV catalog. Exploitation requires a user to load a malicious page, so it is user‑interaction dependent. While the attack vector is likely low in prevalence, the impact on an infected device is significant because sensitive user data can be read by the attacker.

Generated by OpenCVE AI on August 21, 2026 at 17:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome to version 151.0.7922.169 or later, which fixes the CWE-706 reference resolution flaw.
  • If immediate update is not possible, restrict Chrome usage when browsing untrusted sites or disable temporary extensions that could load malicious content.
  • Educate users about phishing, ensuring they recognize that opening unexpected or suspicious links in Chrome can expose data.

Generated by OpenCVE AI on August 21, 2026 at 17:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4749-1 chromium security update
Debian DSA Debian DSA DSA-6455-1 chromium security update
History

Fri, 21 Aug 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 19 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Wed, 19 Aug 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome Android Reference Resolution Bug Allows Sensitive Data Leakage via Crafted HTML chromium-browser: Chromium: Information disclosure via incorrect reference resolution
Weaknesses CWE-386
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N'}

threat_severity

Important

Tue, 18 Aug 2026 22:15:00 +0000

Type Values Removed Values Added
Title Chrome Android Reference Resolution Bug Allows Sensitive Data Leakage via Crafted HTML

Tue, 18 Aug 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 18 Aug 2026 20:45:00 +0000

Type Values Removed Values Added
Description Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-706
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-19T11:26:15.452Z

Reserved: 2026-08-18T19:44:53.304Z

Link: CVE-2026-76039

cve-icon Vulnrichment

Updated: 2026-08-19T11:26:11.710Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-18T21:18:27.947

Modified: 2026-08-21T19:29:26.680

Link: CVE-2026-76039

cve-icon Redhat

Severity : Important

Publid Date: 2026-08-18T20:31:26Z

Links: CVE-2026-76039 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T18:00:16Z

Weaknesses
  • CWE-386

    Symbolic Name not Mapping to Correct Object

  • CWE-706

    Use of Incorrectly-Resolved Name or Reference