Google Chrome CVE-2026-17741

Exploitation requires the victim to actively load attacker-controlled content - the CVSS UI:R and the phrase 'via a crafted HTML page' confirm user interaction is mandatory; there is no unauthenticated remote code path without a user opening the malicious page. The affected surface is specifically Google Chrome / Android WebView on Android prior to 151.0.7922.72, so non-Android or already-patched builds are not exposed. Limiting factors: no authentication is needed (PR:N) but user interaction gates the attack, impact is Low across C/I/A (not full device compromise from this flaw alone), and no known public exploit or active exploitation exists to lower the practical barrier.

Signals are mixed and lean toward moderate-but-not-urgent priority. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) shows a network-reachable, low-complexity, unauthenticated attack, but the impact metrics are only Low across confidentiality, integrity, and availability, and UI:R means a user must be lured into opening a malicious page - this is not wormable drive-by-at-scale. EPSS is low (0.21%, 11th percentile) and consistent with the absence of any KEV listing or known POC, so exploitation probability is currently low. Chromium's own rating of Medium aligns with the Low impact sub-scores despite the elevated 7.1 driven by the Changed scope. Note a data discrepancy: the description and affected-version data clearly scope this to Chrome on Android WebView, yet the vendor reference links point to the desktop Stable channel release note and the CPE is the generic Chrome application entry - verify the exact affected platform/build with Google's advisory before scoping remediation.

An attacker hosts a crafted HTML page and lures a victim into opening it inside a vulnerable WebView-embedding app or Chrome on Android (via a link, ad, or embedded content). The malformed input is processed without adequate validation, letting the attacker escape the renderer sandbox to affect resources outside the isolated web-content process. No public exploit is identified at time of analysis, and the attack requires the victim's interaction (UI:R).