Chrome Android CVE-2026-17953

The victim must be running Google Chrome on Android (not Chrome on Windows, macOS, Linux, or iOS) at a version prior to 151.0.7922.72. Exploitation requires user interaction: the victim must visit or otherwise interact with an attacker-controlled HTML page (UI:R per CVSS vector). The attacker requires no privileges or authentication (PR:N per CVSS vector). The impact is limited to bypassing navigation restrictions - there is no code execution, data exfiltration, or availability disruption implied. The vulnerability is most impactful in environments where WebView navigation policies are used as a security enforcement boundary (e.g., MDM-managed kiosk apps, enterprise mobile apps, banking applications); general Chrome browser users face a lower practical risk because Chrome itself does not routinely enforce strict application-level navigation policies in the same way embedded WebView deployments do. Exploitation on platforms other than Android is not described as possible.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N scores 6.5 (Medium), reflecting a network-reachable, low-complexity attack requiring no attacker privileges but mandating one user interaction - visiting or interacting with a malicious HTML page. The high integrity impact (I:H) reflects that enforced navigation restrictions can be fully bypassed, which is particularly damaging in applications that rely on WebView policy as a security boundary. There is no confidentiality or availability impact. The Chromium security team's internal rating of 'Low' contrasts with the NVD Medium score; this discrepancy likely reflects the difficulty of constructing a realistically dangerous exploit chain from a navigation bypass alone, absent a secondary impact like data theft or code execution. EPSS at 0.18% (8th percentile) confirms that exploitation is not currently observed and probabilistically unlikely in the near term. No CISA KEV listing exists and no public proof-of-concept has been identified at time of analysis. Real-world priority is moderate for organizations whose Android deployments rely on WebView-enforced navigation policies for security, and low for general consumer Chrome users.

An attacker crafts a malicious HTML page that exploits the insufficient policy enforcement in Chrome's WebView and distributes a link to it via phishing email, SMS, or a compromised web resource targeting Android users. When a victim opens the link in Chrome for Android or within an application using an unpatched WebView, the crafted page triggers the policy bypass, navigating the victim to a restricted URL or domain that the application's security policy was designed to block - potentially a phishing site, internal corporate resource, or attacker-controlled content. No public exploit code has been identified at time of analysis, and the attack requires the victim to interact with the attacker-supplied content.