Google Chrome CVE-2026-17736

Exploitation requires two chained prerequisites: (1) the attacker must already have achieved code execution inside the Chrome renderer process on Android, typically via a separate, unpatched memory corruption or logic vulnerability in the renderer; and (2) the victim must actively visit an attacker-controlled HTML page (UI:R). The vulnerability is specific to the WebView component on Android - it does not affect Chrome on desktop platforms or iOS. Non-default or app-level WebView configurations are not required; the flaw exists in the default Android WebView handling. The primary limiting factor is the mandatory renderer pre-compromise: without it, this CVE alone cannot be exploited. Additionally, Chrome's sandboxed renderer runs with highly restricted OS permissions, meaning that even a successful renderer compromise is a prerequisite rather than a complete attack in itself.

The CVSS 5.8 Medium score is structurally appropriate: AV:N reflects network delivery, AC:H correctly captures the high complexity of requiring a pre-existing renderer compromise, UI:R indicates the victim must visit the attacker-controlled page, and S:C acknowledges that successful exploitation crosses a security boundary (the sandbox). Despite the scope change and network vector, AC:H substantially limits practical exploitation - no standalone attack path exists. EPSS at 0.21% (11th percentile) confirms that the security community currently assigns minimal exploitation probability, consistent with the chained nature of the attack. No KEV listing and no public POC further reduce urgency. The real-world risk is low-to-moderate: it is a meaningful component of a full exploit chain but not independently weaponizable. Chrome's auto-update mechanism on Android significantly reduces the exposed population over time. The 'Information Disclosure' tag in the source data understates the actual impact - the CVSS vector's S:C and I:L/C:L/A:L combination reflects a sandbox escape with partial integrity and confidentiality impact, beyond mere disclosure.

An attacker hosts a crafted HTML page and directs a target Android user to visit it, first exploiting a separate renderer-process vulnerability to achieve code execution within the sandboxed renderer. The attacker then leverages the WebView input validation flaw to send malformed data across the renderer-to-browser process boundary, triggering the sandbox escape and gaining execution capabilities beyond the Chrome sandbox in the Android process context. No public POC is available at time of analysis, making this scenario a theoretical chain rather than a demonstrated attack.