Google Chrome Android CVE-2026-17766

Exploitation requires that the attacker deliver a crafted HTML page to a victim browsing with Google Chrome on Android (specifically versions prior to 151.0.7922.72) - the vulnerability does not affect Chrome on desktop platforms. User interaction is required per the CVSS UI:R metric: the victim must actively visit or be redirected to the attacker-controlled page during the same device session. The local attack vector (AV:L) means the attacker must either control web content rendered locally on the device or redirect the victim via phishing/malicious links accessible on the device. No attacker system privileges are required (PR:N). Exploitation is limited by: the Android-only scope of the flaw, the necessity of user interaction, the low confidentiality impact (clipboard data only, no integrity or availability effects), and the absence of any network-reachable attack surface. This is not exploitable remotely against default configurations without the victim visiting the malicious page.

The CVSS 3.3 (Low) score reflects the realistic risk profile accurately. The vector AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N indicates local attack vector, low complexity, no system privileges required, but mandatory user interaction and limited scope (C:L only). The local attack vector (AV:L) is the primary risk-limiting factor - attackers must achieve some form of local or device-proximate access to exploit this. EPSS at 0.13% (3rd percentile) corroborates the low exploitation likelihood. There is no CISA KEV listing and no known public POC, confirming this is not currently a priority threat. No conflicting signals between CVSS and description - the local vector is consistent with the requirement to serve a crafted HTML page to the victim on the same device. For most enterprise environments, this represents a low-priority patching item unless the organization manages shared Android devices or BYOD fleets with elevated clipboard sensitivity.

A threat actor hosts a crafted HTML page that invokes the Clipboard API in a manner that bypasses Chrome's cross-origin input validation on Android. When a victim using Chrome on Android visits this page - potentially via a phishing link or malicious ad - the page silently reads clipboard contents that originated from a different site (for example, a password or session token the user previously copied). No public POC exists at time of analysis, and the attack requires local device access, limiting opportunistic exploitation.