CVE-2026-17802: Chrome Android GPU Info Disclosure Flaw

CVE-2026-17802 Overview

CVE-2026-17802 is a side-channel information leakage vulnerability in the GPU component of Google Chrome on Android. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. The Chromium project rated the security severity as Medium. The weakness is categorized under [CWE-1300] (Improper Protection of Physical Side Channels), reflecting a hardware-adjacent leakage through GPU behavior.

Critical Impact
Remote attackers can exfiltrate cross-origin data from a victim's browser session by luring the user to a malicious page rendered through the vulnerable GPU pipeline.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers sharing the affected GPU rendering path on Android
Downstream Android distributions bundling pre-151 Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17802 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17802

Vulnerability Analysis

The vulnerability resides in the GPU subsystem of Google Chrome on Android. It permits a remote attacker to observe side-channel signals that expose cross-origin content. Because the leakage occurs across the same-origin trust boundary, attacker-controlled pages can infer data belonging to unrelated origins loaded in the same browser instance. Exploitation only requires the victim to load a crafted HTML page, which places the attack within the reach of drive-by web threats.

Root Cause

The root cause is a physical side channel in GPU processing, mapped to [CWE-1300]. Rendering or compute operations performed by the GPU produce observable variations that correlate with cross-origin pixel or texture data. An attacker measures these variations from JavaScript, WebGL, or WebGPU surfaces exposed to web content. See the Chromium Issue Tracker Entry for additional detail.

Attack Vector

The attack vector is remote and web-based. An attacker hosts a crafted HTML page that issues GPU workloads referencing cross-origin resources. The page then measures timing, cache, or rendering side effects to reconstruct protected content. No authentication or elevated privileges are required. User interaction is limited to visiting the attacker's page.

No verified proof-of-concept code is publicly available at this time. Refer to the Google Chrome Release Update for vendor context.

Detection Methods for CVE-2026-17802

Indicators of Compromise

Android devices running Chrome builds earlier than 151.0.7922.72 that visit unfamiliar sites hosting heavy WebGL or WebGPU workloads.
Browser telemetry showing sustained GPU compute activity tied to cross-origin iframes or image resources.
Outbound connections from mobile browsers to domains recently registered and serving graphics-heavy HTML payloads.

Detection Strategies

Inventory Chrome versions on managed Android endpoints and flag any instance below 151.0.7922.72.
Inspect web proxy or DNS logs for user navigation to pages that combine cross-origin embeds with GPU-intensive scripts.
Correlate mobile browser crash reports or GPU process anomalies with the affected version range.

Monitoring Recommendations

Enable mobile threat defense telemetry to surface outdated Chrome installations on Android fleets.
Monitor enterprise browser policy compliance dashboards for delayed Chrome updates.
Track threat intelligence feeds for weaponized proof-of-concept pages targeting this GPU side channel.

How to Mitigate CVE-2026-17802

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later on every managed device.
Push mandatory browser updates through mobile device management (MDM) to eliminate lagging installs.
Restrict access to untrusted sites from mobile devices handling sensitive data until updates are confirmed.

Patch Information

Google addressed the issue in Chrome 151.0.7922.72 for Android. Deployment details are documented in the Google Chrome Release Update and the Chromium Issue Tracker Entry. Administrators should verify update rollout through Google Play managed configurations or their MDM console.

Workarounds

Disable hardware-accelerated GPU features on Android Chrome where policy permits, accepting the performance tradeoff.
Use enterprise browser policies to block navigation to unclassified or newly registered domains on mobile endpoints.
Segment mobile devices that cannot receive the patch immediately from networks handling regulated data.

bash

# Configuration example: enforce minimum Chrome version via Android Enterprise managed config
# Applied through your MDM's Managed Google Play app configuration for com.android.chrome
{
  "MinimumChromeVersion": "151.0.7922.72",
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"]
}