CVE-2026-17794: Google Chrome Android RCE Vulnerability

CVE-2026-17794 Overview

CVE-2026-17794 affects Google Chrome on Android versions prior to 151.0.7922.72. The vulnerability stems from insufficient validation of untrusted input in the mobile Omnibox (URL bar) component. A remote attacker who has already compromised the renderer process can craft an HTML page that spoofs the contents displayed in the Omnibox. Google classified this issue at Chromium security severity Medium. The flaw maps to CWE-20: Improper Input Validation.

Critical Impact
Attackers who control a compromised renderer can display a falsified URL in the address bar, enabling convincing phishing and credential theft against Android Chrome users.

Affected Products

Google Chrome for Android versions prior to 151.0.7922.72
Chromium-based mobile browsers on Android that inherit the vulnerable Omnibox code
Android WebView and derivative browsers built on affected Chromium releases

Discovery Timeline

2026-07-30 - CVE-2026-17794 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17794

Vulnerability Analysis

The vulnerability resides in the Mobile UI component of Google Chrome on Android. The Omnibox performs insufficient validation of untrusted input received from the renderer process. An attacker who has already achieved renderer compromise can send crafted data that the browser process accepts as legitimate address bar content. The result is a mismatch between the URL shown to the user and the origin actually loaded.

Omnibox spoofing weakens a core security boundary of the browser. The address bar is the primary signal users rely on to verify site identity. When that signal is falsified, phishing pages and credential harvesters can appear to originate from trusted domains such as banking, enterprise SSO, or webmail providers.

Exploitation requires chaining with a prior renderer compromise, which typically depends on a separate memory corruption or logic flaw. Once the renderer is under attacker control, the crafted HTML page triggers the input validation gap to project a false URL to the user.

Root Cause

The root cause is improper input validation [CWE-20] in the code path that updates Omnibox contents in the Android build of Chrome. The browser process fails to enforce that address bar state reflects the committed navigation origin when handling messages from an untrusted renderer.

Attack Vector

The attack requires an already-compromised renderer process. The attacker delivers a crafted HTML page, then leverages the validation weakness to modify the visible URL. Users viewing the spoofed Omnibox may enter credentials or authorize actions believing they are on a legitimate site. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Blog for vendor-provided technical context.

Detection Methods for CVE-2026-17794

Indicators of Compromise

Android Chrome installations reporting versions earlier than 151.0.7922.72 in fleet inventory
User reports of address bar contents that do not match the loaded page or that fail to update after navigation
Phishing telemetry showing credential submissions from Android Chrome to domains that mimic trusted brands

Detection Strategies

Query mobile device management (MDM) and endpoint inventory data to identify Chrome for Android versions below 151.0.7922.72
Correlate proxy and DNS logs with user-reported URL mismatches to surface pages that abuse renderer compromise chains
Hunt for renderer exploitation precursors, including anomalous JavaScript compilation crashes or sandbox escape signatures on Android endpoints

Monitoring Recommendations

Track Chrome update compliance across managed Android devices and alert on stalled deployments
Monitor phishing intelligence feeds for campaigns targeting Android Chrome users with crafted HTML payloads
Review user education channels for reports of suspicious address bar behavior and route them to the security operations center

How to Mitigate CVE-2026-17794

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce automatic Chrome updates through Android Enterprise policy on managed devices
Communicate to users that they should verify site identity through additional signals such as certificate details, not the Omnibox alone, until patched

Patch Information

Google addressed the vulnerability in Chrome for Android 151.0.7922.72. Details are published in the Google Chrome Update Blog and tracked in the Chromium Issue Tracker Entry. Users should install the update as soon as it is available in the Play Store.

Workarounds

Restrict browsing to trusted sites and avoid opening untrusted links on Android Chrome until the update is applied
Deploy phishing-resistant authentication such as FIDO2 security keys to reduce credential theft impact from Omnibox spoofing
Use enterprise mobile browser policies to block high-risk categories and enforce Safe Browsing enhanced protection

bash

# Verify Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show 151.0.7922.72 or later
# versionName=151.0.7922.72