Google Chrome CVE-2026-17767

Exploitation requires two distinct pre-conditions: first, the attacker must have already compromised the renderer process in Chrome on Android via a separate vulnerability - this is not a standalone attack. Second, the target must be running Google Chrome on Android prior to version 151.0.7922.72. User interaction is also required (CVSS UI:R), meaning the victim must navigate to or load a crafted HTML page. The vulnerability is platform-specific to Android and does not affect Chrome on other platforms based on available data. Factors limiting exploitation: the requirement for prior renderer compromise is a significant barrier, as is the platform constraint (Android only), making opportunistic mass exploitation implausible.

The provided CVSS 3.1 base score of 4.3 (Medium) reflects AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, which understates the exploitation complexity by assigning AC:L despite the significant prerequisite of a prior renderer compromise. In practice, this is a chained exploit requiring both a renderer exploitation primitive and user interaction, making real-world standalone exploitation unlikely. EPSS at 0.21% (11th percentile) corroborates this - the score indicates very low observed exploitation probability relative to other CVEs. No KEV listing and no public POC further reduce urgency. The impact is limited to confidentiality (cross-origin data leakage) with no integrity or availability consequence. Despite Chrome's ubiquitous deployment, this vulnerability is not a standalone high-priority remediation target; it is most dangerous as a link in a multi-stage exploit chain targeting high-value Android Chrome users.

An attacker who has already exploited a separate renderer-process vulnerability in Chrome on Android crafts a malicious HTML page that exploits the insufficient input validation in WebView to bypass same-origin policy protections. When a targeted user visits or is redirected to this page (providing the required user interaction), the attacker's renderer-side code leaks sensitive cross-origin data - such as authentication tokens or session identifiers from another origin - back to the attacker. No public POC for this specific vulnerability has been identified at time of analysis.