CVE-2026-17651 Google CVE debrief

Who should care

Google Chrome on Android users and administrators, cybersecurity teams, and IT professionals responsible for maintaining browser and system security should be aware of this vulnerability. They should apply the vendor patch to Google Chrome on Android (version 151.0.7922.72 or later), inventory and verify affected systems, monitor for suspicious activity, and implement compensating controls. Additionally, they should track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability has a significant impact on system security and requires prompt action to prevent potential sandbox escapes. The affected product deployments should be reviewed, and compensating controls should be implemented for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. The vulnerability affects various stakeholders, including operators, platforms, vulnerability management teams, and security teams, who should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. The vulnerability requires a thorough review of the system security and immediate mitigation to prevent potential attacks. The CVE record provides limited evidence, and defenders should verify the vulnerability with vendor advisories. The vulnerability has a significant impact on the system security and requires prompt action to prevent potential sandbox escapes. The affected product deployments should be reviewed, and compensating controls should be implemented for exposed systems while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. The vulnerability affects various stakeholders, including operators, platforms, vulnerability management teams, and security teams, who should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mit

Technical summary

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allows remote attackers to potentially perform a sandbox escape via crafted HTML pages. This Critical severity vulnerability requires immediate attention and mitigation. It affects Google Chrome on Android users and administrators, cybersecurity teams, and IT professionals responsible for maintaining browser and system security. The vulnerability has a high CVSS score of 9.6 and is considered Critical by Chromium security severity.

Defensive priority

Critical severity vulnerability in Google Chrome on Android, requiring immediate attention due to potential sandbox escape.

Recommended defensive actions

• Apply vendor patch to Google Chrome on Android (version 151.0.7922.72 or later)
• Inventory and verify affected systems
• Monitor for suspicious activity
• Implement compensating controls
• Exception tracking and retest

Evidence notes

Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity is Critical. Limited evidence available; verify with vendor advisories.

Official resources