CVE-2026-18000

Analyzed Analyzed - Analysis Complete

Insufficient Policy Enforcement in USB in Google Chrome on Android

Publication date: 2026-07-30

Last updated on: 2026-08-03

Assigner: Chrome

Description

Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-08-03

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-18000

EUVD

EUVD-2026-50926

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 151.0.7922.72 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

Executive Summary

This vulnerability is an insufficient policy enforcement issue in the USB component of Google Chrome on Android. It allowed a remote attacker who had already compromised the renderer process to access or leak cross-origin data by tricking a user into visiting a specially crafted HTML page.

Detection Guidance

This vulnerability is specific to Google Chrome on Android and involves insufficient policy enforcement in USB handling. Detection would require checking the Chrome version on Android devices and ensuring it is updated to 151.0.7922.72 or later. No direct commands are provided in the context to detect this issue.

Impact Analysis

If you use Google Chrome on Android before version 151.0.7922.72, an attacker who gains control of the renderer process could potentially steal sensitive data from other websites you visit, even if those sites are from different origins.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, which may violate privacy requirements under GDPR or HIPAA if sensitive personal or health data is leaked. Organizations must ensure affected systems are patched to maintain compliance.

Mitigation Strategies

Update Google Chrome on Android to version 151.0.7922.72 or later to address the insufficient policy enforcement in USB.

Hi! I’m here to help you understand CVE-2026-18000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70