Google Chrome Android CVE-2026-17731

Exploitation requires that the victim is using Google Chrome on an Android device running a version prior to 151.0.7922.72. The Autofill feature must be active, which is Chrome's default configuration. The attacker must socially engineer the victim into visiting a crafted page (UI:R per CVSS), meaning drive-by exploitation without user interaction is not possible. The vulnerability is platform-specific to Android; Chrome on desktop (Windows, macOS, Linux) and iOS is not identified as vulnerable by this CVE. The confidentiality impact is limited (C:L) - the attacker cannot access arbitrary memory or full account credentials, only cross-origin data surfaced through the Autofill mechanism. The SSVC assessment of Automatable: no further confirms that mass-scale automated exploitation is not feasible.

The CVSS 4.3 (Medium) reflects a network-reachable flaw (AV:N) requiring no privileges (PR:N) but demanding user interaction (UI:R) - the victim must navigate to a crafted page - with only partial confidentiality impact (C:L) and no integrity or availability consequences. The EPSS score of 0.21% (11th percentile) places this well below the exploitation-likely threshold, consistent with the SSVC determination of Exploitation: none and Automatable: no. These signals converge: this is a real but modest information-disclosure risk with no evidence of weaponization. The SSVC Technical Impact of partial aligns with the narrow scope of cross-origin data accessible. The primary realistic threat is targeted data-harvesting against specific users rather than mass exploitation. No discrepancy exists between CVSS vector and description - both indicate a remote-delivery, user-interaction-dependent attack. Overall, this is a patch-and-move-on priority rather than an emergency remediation.

An attacker crafts an HTML page that triggers Chrome Android's Autofill to populate or process data from a cross-origin context and exposes it to attacker-controlled JavaScript. When a victim on Android visits this page in Chrome, limited data from another origin - such as previously autofilled form values cached by the browser - may be readable by the malicious page. No public exploit code has been identified at time of analysis.