CVE-2026-17767: Chrome Android WebView Data Leak Flaw

CVE-2026-17767 Overview

CVE-2026-17767 is an input validation vulnerability [CWE-20] in the WebView component of Google Chrome on Android. Versions prior to 151.0.7922.72 fail to properly validate untrusted input, allowing a remote attacker who has already compromised the renderer process to leak cross-origin data through a crafted HTML page. Chromium rates this issue at Medium security severity. The flaw undermines the Same-Origin Policy boundary that WebView enforces between web contexts on Android devices.

Critical Impact
An attacker with a compromised renderer process can bypass cross-origin restrictions in Chrome for Android WebView and exfiltrate sensitive data from other origins.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium WebView component on Android
Downstream Android applications embedding vulnerable Chromium WebView builds

Discovery Timeline

2026-07-30 - CVE-2026-17767 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17767

Vulnerability Analysis

The vulnerability resides in Chrome's Android WebView, the system component that renders web content inside native applications. WebView fails to sufficiently validate untrusted input crossing the renderer boundary. An attacker who has already achieved renderer compromise can supply crafted HTML that manipulates this input path. The result is a cross-origin data leak, exposing content that Same-Origin Policy should isolate. Chromium classifies the finding as Medium severity because exploitation depends on a prior renderer compromise as a prerequisite.

Root Cause

The root cause is improper input validation [CWE-20] in the WebView code path that handles data supplied by the renderer process. Because the browser process implicitly trusts certain inputs from a renderer, malformed or attacker-controlled values are accepted without adequate sanity checks. This weakens the trust boundary between renderer and browser process, which is the primary defense in Chromium's site isolation model.

Attack Vector

Exploitation requires two steps. First, the attacker compromises a renderer process, typically by chaining a separate memory safety or logic bug reachable from a web page. Second, the attacker delivers a crafted HTML page that drives the vulnerable WebView code path to read or return data belonging to a different origin. See the Chromium Issue Tracker #511822402 and the Google Chrome Stable Update for vendor details.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose in the vendor advisory rather than through published exploit code.

Detection Methods for CVE-2026-17767

Indicators of Compromise

Chrome for Android or embedded WebView instances running a version below 151.0.7922.72
Anomalous cross-origin data flows originating from Android applications that embed WebView
Unexpected outbound network traffic from mobile apps immediately after rendering third-party HTML content

Detection Strategies

Inventory Chrome and Android System WebView versions across managed mobile fleets and flag builds prior to 151.0.7922.72
Monitor mobile application traffic for cross-origin requests that deviate from established application baselines
Correlate renderer crash telemetry on Android with subsequent unusual network activity from the same process

Monitoring Recommendations

Ingest mobile device management (MDM) inventory data into your SIEM to track WebView patch levels continuously
Alert on Android applications rendering HTML from untrusted or newly observed domains
Track Chrome Stable Channel release announcements to identify newly disclosed WebView issues affecting your fleet

How to Mitigate CVE-2026-17767

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Update the Android System WebView package to the current release on all managed Android devices
Force application restarts after WebView updates so embedded browsers load the patched library

Patch Information

Google addressed CVE-2026-17767 in Chrome Stable Channel version 151.0.7922.72 for Android. Refer to the Google Chrome Stable Update announcement for release notes. Android System WebView receives the corresponding fix through the Google Play Store update channel.

Workarounds

Restrict Android applications from loading untrusted third-party web content in WebView until patches are deployed
Enforce MDM policies that block installation or execution of apps with out-of-date WebView dependencies
Disable JavaScript in WebView instances that do not require it, reducing renderer attack surface required as a prerequisite

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Verify installed Android System WebView version
adb shell dumpsys package com.google.android.webview | grep versionName