CVE-2026-17698 Google CVE debrief

Who should care

Users of Google Chrome on Android, particularly those handling sensitive data or systems, should be aware of this vulnerability and take action to patch their installations. This includes IT administrators, security teams, and individuals responsible for maintaining Chrome deployments in their organizations. Additionally, operators of sensitive systems or those with elevated access should prioritize patching to prevent potential data leaks or unauthorized access.

Technical summary

Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allows a local attacker to leak cross-origin data via a crafted HTML page. This issue has a High severity rating according to Chromium and a CVSS score of 7.5. The vulnerability affects Google Chrome on Android and requires user interaction. Technical details are limited, but it is known that patching Chrome to version 151.0.7922.72 or later can mitigate this issue.

Defensive priority

Patch Chrome on Android to version 151.0.7922.72 or later to address insufficient validation of untrusted input in UI, potentially leaking cross-origin data.

Recommended defensive actions

• Patch Chrome on Android to version 151.0.7922.72 or later
• Restrict access to sensitive data and systems
• Monitor for suspicious activity
• Implement compensating controls
• Verify inventory of Chrome installations

Evidence notes

The CVE-2026-17698 record indicates insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72, allowing a local attacker to leak cross-origin data via a crafted HTML page. Chromium security severity is High with a CVSS score of 7.5. Evidence is limited to public sources and may not reflect the full scope or impact of this vulnerability. Defenders should verify Chrome installations, review access controls, and monitor for suspicious activity related to this issue.

Official resources