Executive brief
A security vulnerability in Google Chrome for Android could allow a malicious website to bypass the browser's security sandbox. This sandbox is designed to keep web content isolated from the rest of the device; if bypassed, an attacker who has already compromised a browser tab could potentially gain broader access to the underlying mobile operating system. This could lead to the theft of sensitive data or unauthorized control over the device.
Technical details
An improper input validation vulnerability (CWE-20) exists in the WebShare component of Google Chrome for Android. The flaw allows a remote attacker who has already achieved code execution within the sandboxed renderer process to escape that sandbox. By enticing a user to visit a specially crafted HTML page, the attacker can exploit the insufficient validation of untrusted input to interact with higher-privilege browser or OS processes. This vulnerability is rated as High severity by Chromium and was addressed in version 148.0.7778.216.
Affected products
- Google Chrome prior to 148.0.7778.216
Timeline
- 2026-05-27: patched: Stable channel update released
- 2026-05-28: disclosed: CVE published