Google Chrome Android CVE-2026-17901

Exploitation requires the target to be running Google Chrome on Android at a version prior to 151.0.7922.72 and to actively interact with the Sharing feature while exposed to attacker-controlled network traffic (UI:R - a targeted user action, not passive browsing). The CVSS PR:N metric indicates no attacker authentication to the target system is required. Exploitation is strictly limited by the mandatory user interaction prerequisite: users who do not use the Share functionality during an attack window are not exposed. The impact is bounded to limited integrity (navigation bypass only); there is no confidentiality or availability impact. Desktop Chrome is not confirmed affected. Non-default or enterprise-restricted network environments that block attacker-controlled traffic would further reduce exploitability.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N yields a base score of 4.3, reflecting a network-reachable, low-complexity, unauthenticated attack that is gated by mandatory user interaction and produces only limited integrity impact. EPSS at 0.17% (7th percentile) strongly signals low near-term exploitation probability and is consistent with the absence of both a CISA KEV listing and any publicly known proof-of-concept exploit. Chromium's own 'Low' severity classification aligns with this picture. The UI:R constraint is a meaningful real-world limiter - passive browsing without explicitly engaging the Sharing feature does not expose users. The I:L/C:N/A:N impact profile further narrows the blast radius: an attacker who successfully exploits this flaw gains navigation control, not code execution or data exfiltration. Overall risk posture is low-to-medium: patch promptly in routine cycles but no emergency response warranted for most organizations.

An attacker positions themselves to deliver malicious network traffic - for example via a rogue Wi-Fi network or a crafted web resource - to a Chrome for Android user running a version prior to 151.0.7922.72. When the user engages the Sharing feature (e.g., taps 'Share page'), the Sharing component processes attacker-influenced network input without sufficient validation, allowing the attacker to redirect the share flow or bypass navigation restrictions to an unintended destination. No public proof-of-concept exploit code has been identified at the time of analysis.