CVE-2026-19143: 
Google Chrome vulnerability analysis and mitigation

CVE-2026-19143 is a high-severity vulnerability involving insufficient validation of untrusted input in WebAPKs in Google Chrome on Android. It allows a local attacker to potentially perform a sandbox escape via a malicious file. The vulnerability affects Google Chrome on Android prior to version 151.0.7922.109 and was reported internally by Google on 2026-05-29, with the patch disclosed on August 6, 2026. It carries a CVSS v3.1 base score of 8.6 (High) (Chrome Releases, GitHub Advisory).

The root cause is classified as CWE-20 (Improper Input Validation), specifically within the WebAPK subsystem of Chrome on Android. WebAPKs are Android packages generated by Chrome to install Progressive Web Apps (PWAs) natively; insufficient validation of file-based input in this component allows a malicious file to be processed in a way that breaks out of the Chrome sandbox. The attack vector is local, requires no privileges, but does require user interaction (e.g., opening or interacting with a malicious file). The Chromium issue tracker reference is bug #517772612, though full technical details remain restricted pending broader user patching (Chrome Releases, GitHub Advisory).

Successful exploitation allows a local attacker to escape the Chrome sandbox on Android, potentially achieving code execution outside the restricted WebAPK environment. The CVSS scoring reflects high impact across confidentiality, integrity, and availability, with a changed scope indicating that resources beyond the vulnerable component can be affected. This could enable an attacker to access sensitive data stored on the device, modify application data, or disrupt availability of the affected application or broader Android environment (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The EPSS score is approximately 0.127% (3rd percentile), indicating a low near-term probability of exploitation. The NVD SSVC assessment classifies the vulnerability as non-automatable with no known exploitation. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the device and user interaction, limiting the attack surface compared to remote vulnerabilities.

Google has released a fix in Chrome version 151.0.7922.109 for Android (and 151.0.7922.108/.109 for Windows/Mac/Linux). Users should update Google Chrome on Android to version 151.0.7922.109 or later immediately. Enabling automatic updates on Android devices ensures timely receipt of security patches. As an additional precaution, restricting local file access on Android devices and avoiding interaction with untrusted files can reduce exposure (Chrome Releases).

The Chrome 151 update, which includes 41 security fixes (6 Critical, 35 High), received coverage from security news outlets including GBHackers and CyberNoz, which highlighted the breadth of the release. The CIS also issued an advisory noting that multiple vulnerabilities in Google Chrome could allow for arbitrary code execution. No notable individual researcher commentary specific to CVE-2026-19143 has been identified beyond standard patch reporting (Chrome Releases).