CVE-2026-17690 Google CVE debrief

Who should care

Google Chrome users on Android, particularly those with high-risk exposure or handling sensitive data, should prioritize updating to version 151.0.7922.72 or later to address this vulnerability. This includes organizations and individuals using Google Chrome on Android for sensitive operations or storing sensitive data. Vulnerability management and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and security teams should track exceptions, retest remediated assets, and close the item only after evidence is documented. Operators and platform administrators should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Security teams should implement compensating controls and monitor for suspicious activity to mitigate potential impacts. This vulnerability can be addressed by updating Google Chrome to version 151.0.7922.72 or later, restricting access to sensitive data and systems, monitoring for suspicious activity, and implementing compensating controls. Users should verify Android and Chrome versions to ensure they are up-to-date and review the official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review. Finally, users should track exceptions, retest remediated assets, and close the item only after evidence is documented. The goal is to minimize potential impacts and ensure the security of sensitive data and systems. By taking these steps, defenders can effectively address this vulnerability and reduce the risk of exploitation. This requires a proactive,

Technical summary

Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allows a local attacker to leak cross-origin data via a crafted HTML page. This vulnerability affects Google Chrome users on Android, particularly those with high-risk exposure or handling sensitive data. The vulnerability has a CVSS score of 6.5 and a severity of MEDIUM. It is recommended to update Google Chrome to version 151.0.7922.72 or later to address this vulnerability. Additionally, defenders should review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed assets that need extra review.

Defensive priority

Google Chrome users on Android should prioritize updating to version 151.0.7922.72 or later to address this vulnerability.

Recommended defensive actions

• Update Google Chrome to version 151.0.7922.72 or later
• Restrict access to sensitive data and systems
• Monitor for suspicious activity
• Implement compensating controls
• Verify Android and Chrome versions

Evidence notes

The CVE-2026-17690 record indicates insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72, allowing a local attacker to leak cross-origin data via a crafted HTML page. Chromium security severity is High, with a CVSS score of 6.5 and severity of MEDIUM. Evidence is limited to public sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify Android and Chrome versions, review compensating controls, and monitor for suspicious activity.

Official resources