Google Chrome CVE-2026-17994

Exploitation requires the target to be running Google Chrome on an Android device with a Chrome version below 151.0.7922.72. The CVSS vector (UI:R) confirms that user interaction is mandatory - the victim must actively visit a crafted HTML page controlled by the attacker; there is no drive-by vector that bypasses this requirement. No authentication or account access is required (PR:N). Scope is unchanged (S:U), meaning the bypass does not permit sandbox escape or privilege escalation beyond the browser process. Key limiting factors: the vulnerability is Android-platform-specific (desktop Chrome unaffected), user must navigate to attacker-controlled content, and the maximum achievable impact is a navigation restriction bypass with no direct confidentiality or availability consequence. Non-default configurations or special feature enablement are not stated as prerequisites.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) characterizes a network-reachable, low-complexity flaw requiring no authentication but mandating user interaction - the victim must actively visit a malicious page. Scope is unchanged (S:U), confirming exploitation cannot escape the Chrome browser sandbox, and impact is limited solely to integrity (I:L), meaning the attacker can influence navigation but cannot read data or disrupt availability. EPSS of 0.18% at the 8th percentile is a strong downward signal, placing this well below the threshold of opportunistically exploited CVEs. No KEV listing and no publicly available exploit code further reduce urgency. Chromium's own 'Low' severity designation is internally consistent with the narrow impact surface. This is a standard patch-cycle issue: real risk exists on unpatched Android Chrome devices when users visit attacker-controlled pages, but mass exploitation is implausible given the low EPSS, required user interaction, and absence of sandbox escape.

An attacker hosts a crafted HTML page embedding malicious media elements or media event handlers specifically designed to trigger the inappropriate implementation in Chrome's Media component on Android. After luring a victim to the page via phishing, malvertising, or a redirect chain, the crafted content causes Chrome to bypass its navigation restriction logic, allowing the attacker to redirect the browser session to an otherwise restricted URL - potentially a cross-origin resource, internal network endpoint, or a URL scheme that should be blocked. No public exploit code exists at time of analysis, and the low EPSS score indicates this scenario is unlikely to occur at scale.