CVE-2026-17690: Chrome Android PDF Data Leak Vulnerability

CVE-2026-17690 Overview

CVE-2026-17690 affects Google Chrome on Android in versions prior to 151.0.7922.72. The vulnerability stems from insufficient validation of untrusted input in the PDF component. A local attacker can leverage a crafted HTML page to leak cross-origin data from the browser. Chromium's security team rated the underlying issue as High severity. The weakness is classified under CWE-20: Improper Input Validation.

Critical Impact
A crafted HTML page can bypass same-origin protections and exfiltrate cross-origin data through Chrome's PDF handling on Android.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that share the affected PDF component
Embedded Android WebView implementations using vulnerable Chromium PDF code

Discovery Timeline

2026-07-30 - CVE-2026-17690 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17690

Vulnerability Analysis

The vulnerability resides in the PDF handling component of Google Chrome on Android. Chrome renders PDF content inline through an embedded viewer that shares process boundaries with the surrounding page context. Insufficient validation of untrusted input allows a crafted HTML page to influence how PDF content is loaded or referenced. The result is a cross-origin data leak that violates the same-origin policy. Google's Chromium team classified the underlying issue with a High internal severity rating.

The EPSS score is 0.185% at the time of publication, indicating a low near-term probability of observed exploitation attempts. No public exploit or proof-of-concept has been published in the referenced advisories.

Root Cause

The root cause is improper input validation [CWE-20] in the PDF component. The affected code does not sufficiently constrain values or references controlled by an attacker-supplied HTML document. Because the PDF viewer interacts with page-level resources, insufficient validation lets an attacker cross the security boundary between origins. This class of flaw commonly enables one origin to read data that should be inaccessible.

Attack Vector

Exploitation requires a victim to visit a malicious or compromised web page in Chrome on Android. The attacker embeds crafted HTML that interacts with the PDF viewer in a way that triggers the flawed validation path. Once triggered, the attacker's page can read cross-origin data, which may include authenticated content from other sites the user is logged into. The advisory characterizes the attacker as local in the sense of local browser context, not requiring privileged system access.

The vulnerability manifests within Chrome's PDF component on Android. See Chromium Issue Tracking #517129282 and the Google Chrome Stable Update release notes for additional technical context.

Detection Methods for CVE-2026-17690

Indicators of Compromise

Android devices running Chrome versions prior to 151.0.7922.72 accessing untrusted PDF content embedded in web pages
Unusual cross-origin resource requests originating from PDF viewer contexts in browser telemetry
User reports of unexpected data appearing in web applications after visiting third-party pages

Detection Strategies

Inventory Android endpoints and query installed Chrome versions to identify hosts below 151.0.7922.72
Correlate mobile browsing telemetry with visits to pages containing embedded or auto-loaded PDF resources from untrusted origins
Monitor mobile device management (MDM) compliance reports for Chrome update lag on Android fleets

Monitoring Recommendations

Enable Chrome version reporting through enterprise mobility management to track patch adoption
Alert on Android endpoints that remain on outdated Chrome builds beyond the organization's patch SLA
Review web proxy or secure web gateway logs for requests to attacker-controlled domains hosting crafted PDF content

How to Mitigate CVE-2026-17690

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Push forced Chrome updates via enterprise mobile device management for corporate Android fleets
Notify users to avoid opening untrusted links on Android devices until patching is confirmed

Patch Information

Google released the fix in Chrome 151.0.7922.72 for Android. Refer to the Google Chrome Stable Update release notes and Chromium Issue Tracking #517129282 for details on the fix. Android WebView and downstream Chromium-based browsers should apply equivalent updates once available.

Workarounds

Restrict access to untrusted websites on Android devices through enterprise browsing policies until patching is complete
Disable inline PDF rendering where enterprise policy controls permit, requiring downloads to a dedicated viewer instead
Apply network-level filtering to block known malicious domains that host crafted PDF payloads

bash

# Verify Chrome version on Android via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=151.0.7922.72 or higher