CVE-2026-17722 Google CVE debrief

Who should care

Users of Google Chrome on Android, particularly those who may be targeted by remote attackers, should be aware of this High severity vulnerability. IT administrators and security teams responsible for managing Chrome deployments should prioritize patching to prevent potential sandbox escapes. Additionally, developers and users who rely on Chrome's WebView for their applications should take immediate action to mitigate the risk. Security teams should review compensating controls and monitor for suspicious activity related to this vulnerability.

Technical summary

Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is caused by an object lifecycle problem in the WebView component of Google Chrome on Android. This vulnerability can be exploited by a remote attacker who has compromised the renderer process.

Defensive priority

High severity vulnerability in Google Chrome, requiring immediate attention to prevent potential sandbox escapes.

Recommended defensive actions

• Apply the patch to update Google Chrome to version 151.0.7922.72 or later
• Restrict access to untrusted sources
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Evidence is based on official CVE and NVD records. The vulnerability affects Google Chrome on Android, with a CVSS score of 8.3 and a High severity rating. Users should verify their Chrome version and apply patches promptly.

Official resources