Google Chrome CVE-2026-17733

The victim must be running Google Chrome on an Android device with a version prior to 151.0.7922.72 (UI:R - user must visit attacker-controlled page). The attack specifically targets Chrome's QUIC implementation, meaning the target origin or an intermediary must be reachable via QUIC/HTTP3; if QUIC is blocked or disabled by network policy, this specific vector is eliminated. Exploitation is limited to Android - Chrome on Windows, macOS, Linux, or iOS is not stated to be affected. Authentication requirements: CVSS PR:N indicates no attacker privileges are needed to serve the malicious page, but the value of the leaked data depends on whether the victim is authenticated to the targeted cross-origin resource.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. The UI:R metric is a meaningful exploitation barrier - the victim must actively navigate to an attacker-controlled page, preventing fully passive exploitation. Confidentiality impact is limited (C:L), reflecting partial rather than full cross-origin data exposure. EPSS at 0.21% (11th percentile) is consistent with the medium-severity classification and absence of weaponized tooling. No CISA KEV listing and no public POC further support a lower urgency classification. Real-world risk is best described as opportunistic-web-based: meaningful for users who may be enticed to visit malicious pages but not exploitable at scale against unvisited targets. The Android-only scope reduces the exposed surface compared to a cross-platform flaw. No conflicting signals detected between CVSS vector and description.

An attacker registers a domain and serves a crafted HTML page that initiates QUIC-based cross-origin requests designed to exploit the origin validation flaw in Chrome's Android QUIC stack. When a target user on Android visits the page in an unpatched Chrome version, the browser's QUIC implementation leaks response data from a different origin back to the attacker's page context, potentially exposing authenticated session content or sensitive API responses. No public POC is available, and exploitation would require user navigation to the malicious page.