Google Chrome CVE-2026-17793

Exploitation requires the victim to be running Google Chrome on an Android device with a version prior to 151.0.7922.72. The victim must actively open a crafted HTML page - user interaction is mandatory per the CVSS UI:R metric and is the primary exploitation gate. No authentication or special privileges are required on the attacker's side (PR:N). The vulnerability is specific to Chrome's Messages component on Android; desktop Chrome and other browsers are not affected. Exploitation is further limited by the need to socially engineer the victim into clicking a link and interacting with the spoofed UI element to achieve any meaningful attacker objective.

The CVSS 6.5 score (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) is internally consistent with the vulnerability class: network-reachable, no authentication barrier, but requiring active victim interaction. The integrity-only impact (I:H, C:N, A:N) means an attacker cannot directly exfiltrate data or cause a crash - the harm is social engineering and trust subversion. EPSS at 0.21% in the 11th percentile is low, reinforcing that this is not being actively weaponized at scale. There is no CISA KEV listing and no known POC, further depressing operational urgency. The Android-only scope limits the affected population to Chrome mobile users on that platform. Overall risk is moderate in theory but low in practice: the mandatory user-interaction gate and absence of any exploitation signal make this a routine patch-cycle priority rather than an emergency.

An attacker crafts a malicious HTML page designed to render a convincing fake UI - such as a spoofed authentication prompt, a fake system alert, or an impersonated messaging interface - and delivers a link to the victim via a message. When the victim opens the link in Chrome for Android on a vulnerable version, the inappropriate implementation in the Messages component allows the crafted content to misrepresent the interface, potentially tricking the user into submitting credentials or approving a malicious action. No public exploit code exists at time of analysis.