CVE-2026-17733: Google Chrome QUIC Information Disclosure

CVE-2026-17733 Overview

CVE-2026-17733 is an information disclosure vulnerability in the QUIC (Quick UDP Internet Connections) implementation of Google Chrome on Android. Versions prior to 151.0.7922.72 allow a remote attacker to leak cross-origin data through a crafted HTML page. Google's Chromium project has rated the security severity as Medium.

The flaw undermines the browser's same-origin policy by permitting a malicious page to observe data belonging to a different origin. Exploitation requires only that a victim visit an attacker-controlled or compromised web page.

Critical Impact
A remote attacker can leak cross-origin data from a user's browsing session by luring the victim to a crafted HTML page served over QUIC.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that share the vulnerable QUIC implementation
Embedded WebView components on Android built from affected Chromium releases

Discovery Timeline

2026-07-30 - CVE-2026-17733 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17733

Vulnerability Analysis

The vulnerability resides in Chrome's QUIC transport implementation on Android. QUIC is a UDP-based transport protocol that multiplexes streams and integrates TLS 1.3, and Chrome uses it for HTTP/3 connections. An inappropriate implementation in this code path allows information from a resource loaded on one origin to be observed by script running on a different origin.

Cross-origin data leaks of this class typically weaken the guarantees of the same-origin policy, which is the foundation of web isolation. Attackers use such leaks to extract authenticated content, tokens, or metadata from sites where the victim is signed in. Because QUIC operates below the HTTP layer, defects in its handling can bypass higher-level checks that assume the transport is well-behaved.

Google has not published low-level technical detail while user updates roll out. The fix is included in Chrome 151.0.7922.72 for Android, referenced in Chromium Issue Tracker entry 495793059.

Root Cause

The root cause is an inappropriate implementation within the QUIC stack rather than a memory-safety flaw. The condition permits data crossing origin boundaries to be inferred or read by a page the victim visits. Chromium's tracker labels this class of defect as a security bug affecting cross-origin isolation.

Attack Vector

An attacker hosts a crafted HTML page and induces the victim to load it in Chrome for Android. The page issues QUIC-served requests that trigger the flawed code path and expose data associated with another origin. No authentication is required, and interaction is limited to visiting the page. Refer to the Chromium Issue Tracker #495793059 and the Google Chrome Stable Update for the vendor references.

No verified proof-of-concept code is available. Public technical details remain restricted while patches propagate.

Detection Methods for CVE-2026-17733

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72 connecting to unfamiliar hosts over UDP/443 (QUIC).
Web traffic to newly registered or low-reputation domains that serve HTTP/3 responses to mobile user agents.
Repeated cross-origin QUIC requests from a single tab or WebView session to third-party endpoints.

Detection Strategies

Inventory Chrome for Android versions across managed devices and flag builds below 151.0.7922.72.
Inspect proxy or DNS logs for outbound HTTP/3 traffic to domains not associated with sanctioned business use.
Correlate mobile browsing telemetry with threat intelligence feeds to surface known malicious HTML delivery infrastructure.

Monitoring Recommendations

Track Chrome and Android WebView version telemetry from mobile device management (MDM) sources.
Alert on installations of Chrome APKs from non-Play sources on managed Android endpoints.
Monitor for phishing lures directing mobile users to attacker-controlled HTML pages that could stage the exploit.

How to Mitigate CVE-2026-17733

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store.
Push Chrome updates via MDM to all managed Android devices and confirm compliance.
Update Android WebView and any embedded browser components built on affected Chromium versions.

Patch Information

Google released the fix in the Chrome stable channel update announced in the Google Chrome Stable Update. The corresponding Chromium fix is tracked in Chromium Issue Tracker #495793059. Users on Android should install Chrome 151.0.7922.72 or newer.

Workarounds

Disable QUIC in Chrome via the chrome://flags/#enable-quic setting where policy permits, forcing fallback to TCP-based HTTP/2.
Enforce Chrome auto-update policies through Android Enterprise or MDM to shorten patch windows.
Restrict browsing to known-good domains through a secure web gateway until affected devices are updated.

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output after remediation:
# versionName=151.0.7922.72