CVE-2026-17766: Chrome Android Clipboard Data Leak Flaw

CVE-2026-17766 Overview

CVE-2026-17766 is an input validation flaw in the Clipboard component of Google Chrome on Android. Versions prior to 151.0.7922.72 fail to properly validate untrusted input from clipboard interactions. A local attacker can leverage a crafted HTML page to leak cross-origin data from the browser.

The issue is categorized under [CWE-20: Improper Input Validation]. Chromium classifies the security severity as Medium. Exploitation requires the victim to visit or interact with attacker-controlled content on an Android device running an unpatched Chrome build.

Critical Impact
Cross-origin data leakage through the Clipboard interface, breaking the browser's same-origin isolation guarantees on Android.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers on Android that inherit the vulnerable Clipboard implementation
Android WebView components tracking the affected Chromium milestone

Discovery Timeline

2026-07-30 - CVE-2026-17766 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17766

Vulnerability Analysis

The vulnerability resides in Chrome's Clipboard handling on Android. The browser accepts clipboard-related input from web content without sufficient validation. A crafted HTML page can manipulate this pathway to observe or exfiltrate data belonging to other origins.

Cross-origin data leakage undermines the fundamental same-origin policy that isolates web content. An attacker who convinces a user to load a malicious page can bypass this isolation without triggering a memory corruption primitive. The Chromium project rates the severity as Medium because the attacker must lure the user to controlled content and the impact is confidentiality-focused rather than code execution.

Root Cause

The root cause is insufficient validation of untrusted input passed to the Clipboard component. Web-exposed clipboard APIs and internal handlers do not adequately enforce origin boundaries before returning or reflecting data. This maps to [CWE-20: Improper Input Validation].

Attack Vector

An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it. The page issues clipboard operations that manipulate the vulnerable validation logic. The browser then exposes data belonging to a different origin to the attacker's page, enabling exfiltration to a controlled endpoint.

No verified exploit code has been published. For technical context, refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update release notes.

Detection Methods for CVE-2026-17766

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72 browsing untrusted content
Outbound requests from Chrome on Android containing clipboard-derived data to unknown domains
Web pages invoking clipboard read APIs immediately after navigation from unrelated origins

Detection Strategies

Inventory Chrome on Android build versions across managed mobile fleets and flag any host below 151.0.7922.72
Inspect mobile web proxy or DNS telemetry for repeated calls to newly registered domains following clipboard interactions
Correlate Android application version telemetry with browsing telemetry to identify at-risk sessions

Monitoring Recommendations

Enable mobile device management (MDM) reporting on Chrome version compliance for Android endpoints
Log and review Android WebView component versions in enterprise applications
Monitor threat intelligence feeds for public proof-of-concept code targeting Chromium Clipboard handling

How to Mitigate CVE-2026-17766

Immediate Actions Required

Update Google Chrome on Android to 151.0.7922.72 or later through the Google Play Store
Push the update via MDM to managed Android fleets and confirm compliance reporting
Advise users to avoid opening untrusted links on Android until the update is applied

Patch Information

Google addressed the issue in Chrome for Android version 151.0.7922.72. Details are published in the Google Chrome Desktop Update release notes and tracked in the Chromium Issue Tracker Entry. Chromium-based Android browsers and embedded WebView components should adopt the corresponding upstream fix.

Workarounds

Restrict browsing to trusted sites on unpatched Android devices until Chrome is updated
Disable clipboard read permissions for websites through Chrome site settings where feasible
Use enterprise browser policies to block untrusted origins from accessing clipboard APIs

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName