CVE-2026-17681 Google CVE debrief

Who should care

Google Chrome users on Android, particularly those with high-risk exposure or critical infrastructure, should be aware of this vulnerability. IT teams responsible for managing Chrome deployments on Android devices, security teams monitoring Web Authentication usage, and operators of critical systems that rely on Chrome for browsing should prioritize patching and review their current version of Chrome on Android. Additionally, security teams and operators should review Web Authentication usage and consider compensating controls for exposed systems.

Technical summary

The CVE-2026-17681 vulnerability affects Google Chrome on Android, specifically versions prior to 151.0.7922.72. Insufficient validation of untrusted input in Web Authentication allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Users should ensure their Chrome browser is up-to-date to mitigate potential risks. This vulnerability has a critical severity score and requires immediate attention.

Defensive priority

High priority due to critical severity and potential for sandbox escape.

Recommended defensive actions

• Apply patch 151.0.7922.72 or later to Google Chrome on Android
• Monitor for suspicious activity in Web Authentication
• Inventory and verify Chrome versions on Android devices
• Consider compensating controls for Web Authentication
• Review and update Web Authentication usage
• Perform asset inventory of Android devices using Chrome
• Track and verify Chrome updates on Android devices

Evidence notes

Evidence from official vulnerability database and vendor advisory indicates insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72. Limited information available on exploitability and affected scope. Defenders should verify Chrome versions on Android devices, review Web Authentication usage, and monitor for suspicious activity.

Official resources