Google Chrome CVE-2026-17961

Exploitation is limited to Google Chrome on Android prior to version 151.0.7922.72 - desktop Chrome and other platforms are not affected. The victim must interact with a crafted HTML page delivered by the attacker, establishing a mandatory user interaction prerequisite (UI:R in CVSS). No authentication or elevated privileges are required from the attacker's side. The SSVC 'Automatable: no' rating confirms exploitation cannot be reliably automated without human interaction in the loop. The impact ceiling is limited to low integrity - navigation restriction bypass only, with no confidentiality or availability effects, which narrows the viable attack surface to scenarios where navigation control itself has security significance (e.g., bypassing in-app sandboxing or Android intent filters within the Chrome context).

Available signals consistently point to a low operational priority. The CVSS base score of 4.3 (Medium) reflects a constrained impact: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - while no authentication is required and access complexity is low, exploitation demands user interaction (UI:R) and achieves only low integrity impact with no confidentiality or availability effects. EPSS sits at 0.18% (8th percentile), indicating the broader threat intelligence community sees negligible exploitation probability. CISA's SSVC decision framework independently confirms exploitation status as none, automatable as no, and technical impact as partial - a rare alignment across three independent frameworks. No KEV listing and no publicly available POC further reinforce this assessment. The Chromium security team itself rated this Low severity. The primary real-world concern is targeted misuse against users who interact with adversary-controlled web content on Android Chrome, but mass exploitation is not a credible near-term scenario.

An attacker hosts a crafted HTML page designed to abuse Chrome's Android Session handling; when a victim on a pre-151.0.7922.72 Chrome for Android visits the page (via a phishing link, malicious ad, or QR code), the page's navigation logic bypasses restrictions that should block access to certain URLs or navigation targets. The result is a low-integrity violation - for example, redirecting to a restricted in-app URL or bypassing a navigation guard intended to prevent cross-context access. No public proof-of-concept code is known to exist at time of analysis.