PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17802 Google CVE debrief

CVE-2026-17802 is a medium-severity vulnerability in Google Chrome on Android, allowing remote attackers to leak cross-origin data via a crafted HTML page. Defenders responsible for managing and securing Google Chrome installations on Android devices should assess exposure and apply the vendor-provided patch. The vulnerability exists in Google Chrome on Android prior to version 151.0.7922.72. This side-channel information leakage could lead to unauthorized data access. Roles responsible for managing Chrome installations should assess exposure, apply the patch, and verify web application security configurations. The CVE record and NVD entry provide details on this vulnerability. The

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing and securing Google Chrome installations on Android devices should assess exposure and apply the vendor-provided patch.

Why it matters

CVE-2026-17802 is a medium-severity vulnerability in Google Chrome on Android that allows a remote attacker to leak cross-origin data. Defenders should care because it could lead to unauthorized data access. Roles responsible for managing Chrome installations should assess exposure, apply the patch, and verify web application security configurations.

  • Data leakage via side-channel information leakage
  • Potential for unauthorized access to sensitive data
  • Need for patch management and version control
  • Verification of web application security configurations

Technical summary

A side-channel information leakage vulnerability exists in Google Chrome on Android prior to version 151.0.7922.72. This vulnerability allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability is caused by a flaw in the way Google Chrome handles certain types of data. Defenders should review and apply the vendor-provided patch to update Google Chrome to version 151.0.7922.72 or later on Android devices. Additionally, defenders should monitor for and restrict cross-origin data access in their organization's web applications and

Defensive priority

Medium

Recommended defensive actions

  • Review and apply the vendor-provided patch to update Google Chrome to version 151.0.7922.72 or later on Android devices.
  • Monitor for and restrict cross-origin data access in your organization's web applications.
  • Verify that your organization's web applications are not using vulnerable versions of Google Chrome.

Evidence notes

The CVE record and NVD entry provide details on a side-channel information leakage in Google Chrome on Android prior to 151.0.7922.72. The vulnerability allows a remote attacker to leak cross-origin data via a crafted HTML page.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17802 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17802

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17802 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17802

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.