Google Chrome Android CVE-2026-17980

Exploitation requires the target to be running Google Chrome on Android at a version prior to 151.0.7922.72 - desktop or iOS Chrome versions are not indicated as vulnerable. The attacker must successfully deliver a crafted HTML page to the victim and, critically, convince the victim to perform specific UI gestures (the exact gesture sequence is not disclosed in public data; the Chromium issue tracker entry may be access-restricted). This social-engineering dependency is the primary limiting factor: the attack is not automatable (confirmed by SSVC), cannot be silently triggered on page load, and requires active victim participation beyond a simple click. The CVSS AC:H metric independently confirms that exploitation is not straightforward. Impact is restricted to partial confidentiality leakage of cross-origin data; there is no integrity or availability impact, and the vulnerability does not affect systems other than the user's browser session.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N correctly encodes the key limiting factors: high attack complexity (specific UI gestures must be elicited), mandatory user interaction, unchanged scope, and only partial confidentiality impact with no integrity or availability consequence. EPSS at 0.17% (7th percentile) reflects negligible near-term exploitation probability, consistent with SSVC's assessment of 'exploitation: none' and 'automatable: no.' The combination of non-automatable delivery, gesture-dependent exploitation, and low information-disclosure impact makes this a low-priority finding for most organizations. No conflicting signals exist - all available frameworks (CVSS, EPSS, SSVC, KEV absence) converge on low urgency. The Chromium security team itself rated this 'Low' severity. The primary risk applies to high-value targets who might be subjected to targeted social-engineering campaigns.

An attacker crafts a malicious HTML page designed to elicit specific UI gestures from a victim - for example, disguising gesture prompts as CAPTCHA interactions or interactive content - and distributes the link via phishing or malvertising targeting Android Chrome users. When the victim performs the required gestures on the attacker-controlled page, the inappropriate UI implementation in Chrome exposes cross-origin data (such as content from an embedded iframe or a same-device origin) back to the attacking page. No public exploit or proof-of-concept code has been identified at time of analysis.