Google Chrome CVE-2026-17904

The target must be running Google Chrome on an Android device with an NFC-capable hardware stack, using a Chrome version prior to 151.0.7922.72. The attacker must induce the user to visit a crafted HTML page (UI:R per CVSS vector) - exploitation cannot occur without this user interaction step. No authentication or special privilege is required from the attacker's side (PR:N per CVSS vector). No special server-side configuration of the target environment is required; the flaw exists in default Chrome-on-Android behavior when the NFC API is accessible. What limits exploitation: the mandatory user interaction (page visit), the Android-only scope of the NFC API implementation, the low volume of cross-origin data accessible via this vector, and the absence of code execution capability - impact is strictly limited to partial information disclosure.

The CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a remotely triggerable flaw requiring only user interaction (page visit), with no privileges or special configuration needed on the attacker's side. However, the actual risk signals are uniformly subdued: EPSS is 0.17% at the 7th percentile, indicating extremely low observed or predicted exploitation activity; SSVC marks exploitation as none, automatable as no, and technical impact as only partial; the CVE is not in the CISA KEV catalog; and no public exploit code has been identified. The impact is strictly confined to confidentiality (C:L), with no integrity or availability consequence. Chromium itself rates this Low. The AC:L and PR:N metrics could be alarming in isolation, but combined with UI:R and C:L-only impact, this represents a low operational priority - the primary concern is cross-origin data exposure, not code execution or system compromise. There is no conflicting data between signals here; all sources consistently point to a low-priority, theoretical-at-present issue.

An attacker hosts a specially crafted HTML page and socially engineers an Android user into visiting it using Google Chrome prior to 151.0.7922.72. The page exploits the NFC policy enforcement gap to read data from a cross-origin context - for example, content from another tab or origin the user is authenticated to - and exfiltrates it to the attacker-controlled server. No public exploit code has been identified, making this scenario currently theoretical.