What is the CVSS score of CVE-2026-17766?

CVE-2026-17766 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-17766?

Yes, a patch is available for CVE-2026-17766. Update the affected software to the latest version immediately.

Google Chrome Android CVE-2026-17766

EUVD-2026-50715 LOW

Improper Input Validation (CWE-20)

2026-07-30 Chrome

GHSA-f2wx-63q4-4p5q

Information Disclosure Google

3.3

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

Local vector confirmed by description; no system privileges needed but user must visit attacker page; impact is confidentiality-only, limited to clipboard data.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:49 vuln.today

Patch available

Jul 30, 2026 - 02:02 EUVD

CVE Published

Jul 30, 2026 - 00:19 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 00:19 cve.org

LOW 3.3

DescriptionCVE.org

Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.

Technical ContextAI

The root cause is CWE-20 (Improper Input Validation) within Chrome's Clipboard API implementation on Android. Android's clipboard model differs from desktop operating systems - it permits inter-app clipboard access that, combined with inadequate origin validation in Chrome's Clipboard handler, creates a cross-origin data boundary violation. The affected product is identified by CPE cpe:2.3:a:google:chrome, and the description explicitly scopes the vulnerability to Android builds only, suggesting the flaw may be tied to Android-platform-specific clipboard APIs or Chrome's Android-specific rendering path. The vulnerability enables information disclosure across origins - for example, data copied from a sensitive site (banking, email) could be exfiltrated by a malicious page loaded in the same browser session.

RemediationAI

Update Google Chrome on Android to version 151.0.7922.72 or later via the Google Play Store or Chrome's built-in update mechanism; this is a vendor-released patch confirmed by the Chrome Releases blog at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As a compensating control prior to patching, users should avoid copying sensitive data (credentials, tokens, personal information) to the clipboard while browsing untrusted or unknown websites on Android Chrome. Site-level clipboard permissions can be reviewed and restricted within Chrome's Android site settings (Settings > Site Settings > Clipboard), which limits clipboard API access for untrusted origins - note this may break legitimate clipboard functionality on some web applications. No significant functional side effects are expected from applying the patch.