CVE-2026-17866 Google CVE debrief

Who should care

Users of Google Chrome on Android, particularly those who may be targeted by remote attackers, should be aware of this vulnerability and take steps to protect themselves. This includes updating Google Chrome to the latest version and monitoring for suspicious activity. Additionally, security teams and vulnerability management teams should prioritize patching and verifying the vulnerability status of their assets.

Technical summary

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome on Android versions prior to 151.0.7922.72. The vulnerability has a Medium security severity level according to Chromium. Users should verify their version and update to the latest version if necessary. The vulnerability allows for a potential sandbox escape, which could lead to unauthorized access or further exploitation. It is essential for users to update Google Chrome on Android to version 151.0.7922.72 or later to mitigate this vulnerability.

Defensive priority

Medium severity vulnerability in Google Chrome on Android, requiring user interaction, with potential for sandbox escape.

Recommended defensive actions

• Apply the update to Google Chrome on Android to version 151.0.7922.72 or later.
• Ensure that Google Chrome on Android is up-to-date.
• Monitor for any suspicious activity related to this vulnerability.
• Consider implementing additional security measures to prevent exploitation.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Medium. The vulnerability affects Google Chrome on Android versions prior to 151.0.7922.72. Users should verify their version and update to the latest version if necessary. The vulnerability has been publicly disclosed and patched.

Official resources