Google Chrome CVE-2026-17805

Exploitation requires the victim to be running Google Chrome for Android on a version prior to 151.0.7922.72 with the Glic component active (default state in affected versions). The CVSS PR:N confirms no attacker-side authentication or account privileges are needed. However, UI:R mandates active victim participation - the user must visit the attacker-controlled crafted HTML page; passive or drive-by exploitation without a deliberate page visit is not possible per the CVSS vector. The vulnerability is platform-scoped to Android; Chrome on desktop operating systems is not implicated. No non-default configuration setting is identified as a prerequisite beyond simply running an unpatched Chrome version on Android with Glic active. Limiting factors for defenders: user interaction requirement, Android-only scope, no confirmed exploitation in the wild, and very low EPSS score all reduce realistic risk beyond the raw CVSS.

The CVSS 6.5 score with AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N characterizes a medium-severity network-exploitable flaw: low attack complexity, no required attacker privileges, but mandatory user interaction limits autonomous exploitation. The High integrity impact reflects navigation restriction bypass rather than code execution or data exfiltration, which contextually bounds the worst-case outcome. EPSS at 0.18% (8th percentile) is very low, indicating that exploitation at scale has not been observed in practice. The absence of a CISA KEV listing and no identified public exploit code further support low near-term exploitation risk. The Android-only platform scope narrows the affected population relative to a cross-platform Chrome flaw, though Chrome's ubiquitous Android presence means absolute exposed user count remains large. The Tags field flags this as an authentication bypass category, consistent with the navigation policy enforcement bypass described. Overall, this is a genuine but moderate-priority patching item - real-world exploitation risk is low relative to the CVSS score due to user interaction requirements and absence of confirmed exploitation activity.

An attacker registers or compromises a web domain and hosts a crafted HTML page engineered to trigger Glic's insufficient policy enforcement. The attacker distributes a link via phishing email, malicious advertisement, or compromised site to lure Android Chrome users. When a victim running Chrome below 151.0.7922.72 visits the page, the Glic component processes the HTML without enforcing navigation restrictions, allowing the attacker to redirect the victim to a destination that Chrome's policy would otherwise block. No public exploit code has been identified at time of analysis.