CVE-2026-17980 Google CVE debrief

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and prioritize updating to the fixed version. Users engaging with untrusted HTML pages via Chrome on Android are at risk. Defenders should verify Chrome on Android version 151.0.7922.72 or later is deployed and implement compensating controls for high-risk users.

Why it matters

CVE-2026-17980 is a low-severity vulnerability in Google Chrome on Android that allows cross-origin data leaks via UI interactions. Defenders should prioritize verifying Android Chrome versions and ensuring users are updated to 151.0.7922.72 or later.

• Verify Chrome on Android version 151.0.7922.72 or later is deployed
• Monitor for potential UI-based attacks
• Implement compensating controls for high-risk users

Technical summary

The vulnerability is caused by inappropriate implementation in the UI of Google Chrome on Android prior to version 151.0.7922.72. A remote attacker can convince a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. This issue has a low severity rating according to Chromium security severity ratings. Defenders should prioritize verifying Android Chrome versions and ensuring users are updated to 151.0.7922.72 or later. They should also monitor for potential UI-based attacks and implement compensating controls for high-risk users.

Defensive priority

Defenders should prioritize verifying Android Chrome versions and ensuring users are updated to 151.0.7922.72 or later. Monitor for potential UI-based attacks and implement compensating controls for high-risk users.

Recommended defensive actions

• Verify Android Chrome versions and update to 151.0.7922.72 or later
• Monitor for potential UI-based attacks
• Implement compensating controls for high-risk users
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its severity, and affected versions. Chromium security severity is rated as Low. The vulnerability was published on 2026-07-30T01:17:02.587Z and has not been modified since then. There are limited details available on the source of this information, so defenders should verify Chrome on Android versions and monitor for potential UI-based attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.