CVE-2026-17793: Google Chrome Android XSS Vulnerability

CVE-2026-17793 Overview

CVE-2026-17793 is a user interface (UI) spoofing vulnerability in the Messages component of Google Chrome on Android prior to version 151.0.7922.72. A remote attacker can exploit this flaw by serving a crafted HTML page, causing Chrome to render UI elements in a way that misrepresents content to the user. Google classifies the Chromium security severity as Medium.

UI spoofing weaknesses enable phishing, credential theft, and social engineering by making malicious content appear to originate from a trusted source. The issue is fixed in Chrome for Android 151.0.7922.72.

Critical Impact
A remote attacker can spoof browser UI elements on Android through a crafted HTML page, enabling convincing phishing and social engineering attacks against Chrome users.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that share the affected Messages implementation
Mobile deployments that have not applied the Chrome Stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-17793 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17793

Vulnerability Analysis

The vulnerability resides in the Messages component of Google Chrome on Android. According to the vendor advisory, the component contains an inappropriate implementation that a remote attacker can leverage to perform UI spoofing through a crafted HTML page. The flaw belongs to the User Interface Confusion class of weaknesses.

UI spoofing in mobile browsers typically allows attacker-controlled content to overlap, obscure, or imitate legitimate browser chrome such as the address bar, security indicators, or system dialogs. Users who trust the spoofed interface may disclose credentials, approve permissions, or install malicious content believing they are interacting with a trusted origin.

The issue is limited to the Android build of Chrome. Desktop channels are not referenced in the advisory. Google has not published detailed technical internals, consistent with its standard practice of restricting exploit details until patch adoption reaches a threshold.

Root Cause

The root cause is an inappropriate implementation in the Messages subsystem of Chrome for Android. Messages is the surface Chrome uses to display transient prompts and notifications on mobile. Incorrect handling of attacker-controlled content within this surface allows the visual state of the browser to diverge from its actual security context.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page under attacker control. No authentication is required, and the attack is delivered over the network. See the Chromium Issue Tracker entry and the Google Chrome Stable Update for the vendor's published references.

// No public proof-of-concept code is available for CVE-2026-17793.
// Refer to the Chromium Issue Tracker entry (restricted) for technical details.

Detection Methods for CVE-2026-17793

Indicators of Compromise

Android devices running Google Chrome versions prior to 151.0.7922.72
Web traffic to unfamiliar domains hosting HTML pages that render overlays or content mimicking browser prompts
User reports of unexpected credential prompts, permission requests, or address bar inconsistencies inside Chrome for Android

Detection Strategies

Inventory installed Chrome versions across managed Android endpoints and flag any build below 151.0.7922.72
Correlate mobile web proxy logs with threat intelligence feeds to identify visits to known phishing infrastructure that abuses browser UI spoofing
Monitor for anomalous credential submissions from mobile user agents following visits to newly registered or low-reputation domains

Monitoring Recommendations

Ingest Chrome Mobile version telemetry from mobile device management (MDM) or unified endpoint management (UEM) tooling into a centralized analytics platform
Alert on user-reported phishing incidents originating from Android Chrome sessions and pivot on referring URLs
Track patch compliance rates for Chrome on Android and escalate devices that remain on vulnerable builds beyond the organization's remediation SLA

How to Mitigate CVE-2026-17793

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Push the updated Chrome build to managed Android devices using MDM policies to enforce automatic application updates
Reinforce user awareness that legitimate browser prompts should be verified against the address bar and lock indicator before entering credentials

Patch Information

Google addressed CVE-2026-17793 in Chrome for Android 151.0.7922.72. Details are published in the Google Chrome Stable Update announcement. Deploy the updated version through Google Play or enterprise mobile management channels.

Workarounds

Restrict access to untrusted websites on mobile devices through DNS filtering or secure web gateway policies until patches are applied
Disable link previews and message-rendering features where organizational policy permits, reducing exposure to crafted HTML content
Train users to close and reopen Chrome if browser UI appears inconsistent, and to avoid entering credentials from prompts triggered by unfamiliar sites

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=151.0.7922.72 or later