Google Chrome CVE-2026-17915

The victim must be running Google Chrome on Android with a version strictly below 151.0.7922.72 (per EUVD affected version range). The attacker must deliver a crafted HTML page to the victim and the victim must actively navigate to it in Chrome - user interaction is required per CVSS UI:R. No authentication, privileged account, or special server-side configuration is required on the attacker's side. Exploitation is explicitly scoped to the Android platform; Chrome on Windows, macOS, or Linux is not identified as affected. The impact is limited to UI spoofing - an attacker cannot directly read files, execute code, or modify persistent data through this vulnerability alone. The primary limiting factor is the necessity of user-initiated navigation to a malicious page, which reduces mass exploitation risk.

The CVSS 3.1 score of 5.4 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L signals a medium-severity, network-reachable attack requiring user interaction, with limited confidentiality and availability impact. However, several signals collectively lower the real-world priority: the EPSS score of 0.17% at the 7th percentile indicates that historically similar vulnerabilities are rarely exploited in practice; there is no CISA KEV listing; no public exploit code has been identified at time of analysis; and Chromium's own team assigned this a 'Low' severity rating internally. The A:L availability metric in the original CVSS vector is atypical for a UI spoofing vulnerability and may reflect conservative vendor scoring rather than a concrete availability degradation. The primary risk is enabling phishing or credential harvesting by deceiving users about the displayed origin - not direct code execution or data exfiltration. This vulnerability is appropriate to address in a standard patch cycle rather than emergency remediation.

An attacker registers a domain and hosts a crafted HTML page designed to trigger the WebView inappropriate implementation, then distributes the link via phishing email, SMS, or social media targeting Android Chrome users. When the victim visits the page on an unpatched device, the browser renders spoofed UI elements - such as a fake browser chrome, false security lock icon, or counterfeit login prompt - that make the malicious origin appear legitimate, potentially leading the user to submit credentials or approve actions under a false sense of trust. No public exploit code has been identified at time of analysis, and the attack requires the user to actively navigate to the attacker-controlled page.