Google Chrome Android CVE-2026-17925

The target device must be running Google Chrome on Android (not desktop Chrome) with a version prior to 151.0.7922.72 - desktop platforms are not in scope. The Cast feature must be available in the browser, which it is by default on Android Chrome. The attacker must successfully induce the user to visit a crafted HTML page (CVSS UI:R), requiring a social engineering vector such as phishing, malvertising, or a compromised link. No authentication or privileges are required from the attacker's side (PR:N). Exploitation is bounded to integrity impact only - the attacker cannot read sensitive data or cause denial of service through this vulnerability alone. The combination of required user interaction, Android-only scope, and integrity-limited impact significantly narrows the realistic exploitation window compared to the broad CPE string suggests.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N yields 4.3 (Medium), driven primarily by the network-accessible, low-complexity attack surface, partially offset by the requirement for user interaction and the limited integrity-only impact. EPSS at 0.18% (8th percentile) strongly corroborates low exploitation probability - consistent with the vendor's own 'Low' Chromium severity classification. There is no CISA KEV listing and no public proof-of-concept code identified, confirming this is not a current active-exploitation priority. The absence of confidentiality or availability impact further limits attacker incentive - a SOP bypass with integrity-only effect is a constrained primitive. The S:U assignment in the provided CVSS vector warrants scrutiny: a same-origin policy bypass by definition crosses origin boundaries, which is characteristic of a scope change; defenders should note this potential underscoring of the cross-origin impact dimension. Overall, this is a real but low-urgency vulnerability - patch during the next regular update cycle rather than emergency remediation.

An attacker hosts a crafted HTML page that exploits the improper origin validation in Chrome's Cast component on Android, then delivers a link to the target via phishing email, SMS, or a malicious advertisement. When the victim opens the link in Chrome for Android on an unpatched device, the page triggers a cross-origin write operation, potentially altering state or content on a different trusted origin within the browser session. No public proof-of-concept code has been identified at time of analysis, and no active exploitation has been reported.