CVE-2026-17713: Google Chrome Android RCE Vulnerability

CVE-2026-17713 Overview

CVE-2026-17713 is an input validation flaw [CWE-20] in the Accessibility component of Google Chrome on Android. Versions prior to 151.0.7922.72 fail to properly validate untrusted input inside the accessibility subsystem. A remote attacker who has already compromised the renderer process can leverage a crafted HTML page to escape the Chrome sandbox on Android. Google Chromium rates the security severity as High. Successful exploitation moves an attacker from a constrained renderer context into a broader browser process context, expanding access to device resources.

Critical Impact
Sandbox escape from a compromised renderer allows attackers to break Chrome's primary isolation boundary on Android, enabling broader access to user data and device capabilities.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers on Android inheriting the vulnerable Accessibility code
Android WebView components depending on the affected Chromium build

Discovery Timeline

2026-07-30 - CVE-2026-17713 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17713

Vulnerability Analysis

The vulnerability lives in the Accessibility subsystem of Chrome on Android. Accessibility features bridge renderer-supplied data with higher-privileged browser and OS components that expose UI structure to assistive technologies. When the accessibility layer accepts untrusted input from a renderer without sufficient validation, the trust boundary between renderer and browser breaks down. An attacker who has already achieved code execution in the renderer can craft accessibility messages that the browser process mishandles. This mishandling produces a sandbox escape, which Chromium classifies as High severity because the renderer sandbox is a foundational Chrome isolation guarantee.

Root Cause

The root cause is improper validation of untrusted input [CWE-20] in accessibility message handling. The browser process trusts data structures produced by a renderer without enforcing sufficient constraints on their contents. See the Chromium Issue Tracker Entry for further technical detail.

Attack Vector

Exploitation requires a two-stage chain. First, the attacker compromises the renderer process, typically through a separate memory corruption or type confusion bug reached from a malicious web page. Second, the attacker sends crafted accessibility data from the compromised renderer to trigger the flaw in the browser process. The delivery mechanism is a crafted HTML page loaded by the victim in Chrome on Android.

No verified public exploit code is available. See the Google Chrome Stable Update advisory for the vendor description.

Detection Methods for CVE-2026-17713

Indicators of Compromise

Chrome for Android installs reporting versions earlier than 151.0.7922.72 on managed devices
Chrome renderer or browser process crashes correlated with accessibility events on Android endpoints
Unexpected Chrome child process behavior following navigation to untrusted HTML pages

Detection Strategies

Inventory installed Chrome for Android versions across managed mobile fleets and flag builds below 151.0.7922.72
Monitor mobile device management (MDM) telemetry for Chrome update compliance status
Correlate web proxy or DNS logs with visits to untrusted or newly registered domains serving HTML content to Android Chrome users

Monitoring Recommendations

Track Chrome release channel advisories and align patch verification cadence with the Chrome stable channel
Ingest MDM and mobile threat defense telemetry into a centralized data lake for version compliance reporting
Alert on browser process crashes on Android endpoints where mobile crash reporting is available

How to Mitigate CVE-2026-17713

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce Chrome auto-update policies on managed Android devices via MDM configuration
Audit device inventories to confirm no Android endpoints remain on vulnerable Chrome builds

Patch Information

Google addressed the vulnerability in Chrome for Android 151.0.7922.72. Refer to the Google Chrome Stable Update release notes and the Chromium Issue Tracker Entry for the fix reference. Update Chrome through the Google Play Store or enterprise mobile management tooling.

Workarounds

Restrict Chrome for Android usage on unpatched devices until updates propagate through the Play Store
Use MDM policies to block navigation to untrusted domains from mobile browsers where feasible
Apply network-layer filtering to reduce exposure to malicious HTML content served from unknown sources

bash

# Verify Chrome for Android version via ADB on a managed device
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output: versionName=151.0.7922.72 (or later)