Google Chrome Android CVE-2026-17938

Exploitation requires an Android user to visit an attacker-controlled HTML page using Google Chrome for Android prior to version 151.0.7922.72. The vulnerability is triggered when the crafted page invokes the FullScreen API, which then incorrectly renders UI elements to spoof browser indicators. User interaction is required per CVSS UI:R - the user must navigate to or be redirected to the malicious page. No authentication, local access, server-side configuration, or non-default browser settings are required to trigger the flaw. Limiting factors: restricted to the Android platform only (not desktop or iOS); impact is confined to UI spoofing with no code execution or data exfiltration capability; user must interact with the malicious page; the low EPSS and Chromium 'Low' severity rating indicate this is not a widely pursued attack surface.

The CVSS base score of 4.3 (Medium) is composed of AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - network-reachable, low complexity, no privileges required, but user interaction is mandatory. Impact is limited to low integrity (UI spoofing) with no confidentiality or availability consequence and no scope change. The EPSS of 0.21% at the 11th percentile is very low, indicating minimal real-world exploitation interest from threat actors relative to the broader vulnerability population. Chromium's own security team rated this 'Low,' which is notably conservative compared to the NVD CVSS 4.3 score - the Chromium assessment should be weighted accordingly. No CISA KEV listing and no public exploit code have been identified. Taken together, this is a low real-world priority: it requires active user interaction, produces only a spoofed UI (no code execution, no data exfiltration), is platform-specific to Android, and has extremely low observed exploitation probability. The primary threat scenario is targeted phishing, not mass exploitation.

An attacker sends a phishing link to an Android Chrome user directing them to a malicious page that immediately invokes the FullScreen API upon load. With the browser chrome (URL bar and security indicators) suppressed by fullscreen mode, the page renders a convincing counterfeit browser interface displaying a trusted domain, prompting the user to enter credentials into an attacker-controlled form. No public proof-of-concept code has been identified at time of analysis.