PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-17949 Google CVE debrief

CVE-2026-17949 is a vulnerability in Google Chrome on Android prior to version 151.0.7922.72, which allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a CVSS score of 4.3 and is classified as MEDIUM severity. This vulnerability affects Google Chrome on Android deployments, and defenders should verify and apply the patch to prevent potential data leaks. The vulnerability was reported by an external researcher and is classified as Low severity by Chromium.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for Google Chrome on Android deployments should verify and apply the patch to prevent potential data leaks. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the patch is applied to prevent data leaks and maintain the security of their deployments.

Why it matters

CVE-2026-17949 is a MEDIUM severity vulnerability in Google Chrome on Android that allows remote attackers to leak cross-origin data. Defenders should prioritize verifying and applying the patch to prevent potential data leaks.

  • Data leaks may occur if the patch is not applied
  • Defenders should verify and apply the patch to prevent potential data leaks
  • The vulnerability has a MEDIUM severity and a CVSS score of 4.3

Technical summary

The vulnerability is caused by an uninitialized use in the GPU of Google Chrome on Android prior to version 151.0.7922.72. This allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects Google Chrome on Android and has a CVSS score of 4.3, classified as MEDIUM severity. Defenders should prioritize verifying and applying the patch to prevent potential data leaks.

Defensive priority

Defenders should prioritize verifying and applying the patch to prevent potential data leaks.

Recommended defensive actions

  • Verify and apply the patch to Google Chrome on Android
  • Monitor for potential data leaks
  • Review and update incident response plans

Evidence notes

The vulnerability was reported by an external researcher and is classified as Low severity by Chromium. The CVE record and NVD entry provide details on the vulnerability, but further verification is required to determine the full impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-17949 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-17949

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-17949 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-17949

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.