PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-18000 Google CVE debrief

CVE-2026-18000 is a low-severity vulnerability in Google Chrome on Android, allowing a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was published on 2026-07-30T01:17:04.690Z and last modified on 2026-10-23T22:10:00.160Z. This issue arises from insufficient policy enforcement in USB, which can be exploited by a remote attacker who has compromised the renderer process. Defenders should assess exposure and prioritize updates to mitigate the risk of cross-origin data leaks.

Vendor
Google
Product
Chrome
CVSS
LOW 3.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-30
Original CVE updated
2026-10-23
Advisory published
2026-07-30
Advisory updated
2026-10-23

Who should care

Defenders responsible for managing Google Chrome on Android deployments should assess exposure and prioritize updates to mitigate the risk of cross-origin data leaks.

Why it matters

CVE-2026-18000 is a low-severity vulnerability in Google Chrome on Android, allowing a remote attacker to leak cross-origin data via a crafted HTML page. Defenders should prioritize verifying Chrome versions and updating to 151.0.7922.72 or later.

  • Verify Chrome versions to prevent cross-origin data leaks
  • Enforce security policies for USB connections to limit data access
  • Monitor for suspicious cross-origin data access attempts to detect potential exploitation

Technical summary

Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allows a remote attacker who has compromised the renderer process to leak cross-origin data via a crafted HTML page. This vulnerability highlights the importance of keeping Chrome updated to prevent cross-origin data leaks through USB connections. Defenders should prioritize verifying Chrome versions and updating to 151.0.7922.72 or later.

Defensive priority

Defenders should prioritize verifying Chrome versions and updating to 151.0.7922.72 or later, as insufficient policy enforcement in USB allows for cross-origin data leaks.

Recommended defensive actions

  • Verify Chrome versions and update to 151.0.7922.72 or later
  • Review and enforce security policies for USB connections
  • Monitor for suspicious cross-origin data access attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its low severity and the need for Chrome updates to 151.0.7922.72 or later. Evidence is limited to public sources, and defenders should verify Chrome versions and review security policies for USB connections to prevent exploitation. The CVE Program and NVD detail pages offer official guidance on this vulnerability.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-18000 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-18000

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-18000 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-18000

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.