Google Chrome CVE-2026-17802

The victim must be using Google Chrome on an Android device running a version prior to 151.0.7922.72 - desktop Chrome is not indicated as vulnerable. The victim must visit a crafted HTML page under attacker control (UI:R), which is the only required user interaction; no authentication, account, or special browser setting is required on the victim side. Exploitation is limited to leaking cross-origin data that the victim's browser is actively processing or that can be induced to load during the attacker's page session. The attack is constrained to the Android GPU driver stack and does not apply to Chrome on Linux, Windows, or macOS. The CVSS PR:N metric confirms no authentication or account privileges are required from the attacker.

The CVSS 3.1 base score of 4.3 (Medium) is internally consistent: AV:N and PR:N indicate the attack is remotely triggerable without credentials, but UI:R requires the victim to visit a malicious page, and C:L reflects only partial data disclosure. S:U (unchanged scope) confirms containment within the browser process. The EPSS score of 0.17% at the 7th percentile strongly suggests this vulnerability has not attracted mass exploitation tooling and is not being actively targeted at scale. There is no CISA KEV listing and no publicly known proof-of-concept. The Android-platform specificity further narrows the realistic attack surface compared to a cross-platform Chrome flaw. Despite the low EPSS, the information disclosure class is meaningful in high-value browsing sessions (e.g., authenticated banking or healthcare portals viewed on Android). The primary real-world risk is targeted espionage against specific individuals rather than opportunistic mass exploitation. Overall, this is a genuine but moderate-priority issue - update promptly but it does not warrant emergency out-of-band response for most organizations.

An attacker hosts a malicious web page containing crafted HTML and JavaScript that triggers specific GPU workloads designed to produce measurable side-channel signals. When a victim on an Android device visits this page using Chrome (e.g., via a phishing link or malvertising), the attacker-controlled GPU workloads interfere with GPU processing of co-rendered cross-origin content - such as an embedded iframe from a banking site - and timing or resource observations allow partial reconstruction of that content. No public proof-of-concept code has been identified at time of analysis, making reliable exploitation likely require significant GPU side-channel research expertise.