Google Chrome CVE-2026-17808

Exploitation requires that the victim visit a crafted HTML page using Google Chrome on an Android device running a version prior to 151.0.7922.72. The WebGL API must be enabled, which is the default configuration in Chrome; no non-default setting is required. User interaction is mandatory - the victim must actively navigate to or load the attacker-controlled page (consistent with UI:R in the CVSS vector). No authentication or privileges are required of the attacker (PR:N). Exploitation is limited to Android; Chrome on Windows, macOS, Linux, and iOS is not indicated as vulnerable. The impact is confined to confidentiality - no modification of data or denial of service is achievable via this vector alone.

The NVD-assigned CVSS 3.1 score of 4.3 (Medium) reflects a network-exploitable, low-complexity flaw requiring no privileges but mandating user interaction (UI:R), with a limited confidentiality impact (C:L) and no integrity or availability consequences. EPSS at 0.23% (14th percentile) strongly corroborates that real-world exploitation is not currently widespread. The vulnerability is not in CISA KEV, and no POC has been identified. The Android-platform restriction meaningfully limits the attack surface relative to a cross-platform Chrome flaw. Taken together, these signals position this as a medium-severity, low-urgency issue for most enterprise environments - patching is warranted on the normal patch cycle rather than as an emergency. One caveat: uninitialized memory leaks can occasionally be chained with other primitives for more powerful attacks, but no such chain is evidenced in the available data.

An attacker hosts a crafted HTML page containing malicious WebGL shader or buffer code designed to read uninitialized GPU or CPU memory. When an Android Chrome user visits the page - for example, via a phishing link or malicious ad - the WebGL subsystem reads uninitialized memory and the page's JavaScript can observe the resulting data, potentially extracting fragments of cross-origin content such as cookies, tokens, or DOM data from previously loaded pages. No public exploit code exists, so exploitation currently requires independent discovery of a working proof of concept.