CVE-2026-17860: Chrome Android URL Spoofing Vulnerability

CVE-2026-17860 Overview

CVE-2026-17860 affects Google Chrome on Android prior to version 151.0.7922.72. The vulnerability stems from insufficient validation of untrusted input in the Mobile component. A local attacker can spoof the contents of the Omnibox (URL bar) by delivering a malicious file to the target device. Chromium classifies the security severity as Medium. The flaw is tracked under [CWE-20] Improper Input Validation and enables user interface deception rather than direct code execution. Spoofed Omnibox content can mislead users about the true origin of displayed web content, undermining trust decisions built into the browser address bar.

Critical Impact
A local attacker delivering a malicious file to an Android device running vulnerable Chrome can display arbitrary URLs in the Omnibox, enabling convincing phishing and origin-confusion attacks.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers sharing the affected Omnibox rendering code
Android devices running unpatched Chrome Stable channel builds

Discovery Timeline

2026-07-30 - CVE CVE-2026-17860 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17860

Vulnerability Analysis

The vulnerability resides in the Mobile input-handling path of Google Chrome on Android. Chrome fails to properly validate untrusted input associated with a malicious file, and the Omnibox subsequently renders attacker-controlled content in place of, or overlapping with, the legitimate URL. The Omnibox is the primary trust indicator users rely on to identify the origin of loaded content. When it displays incorrect information, downstream security guarantees such as same-origin reasoning by end users collapse. This class of defect is categorized as user interface confusion driven by improper input validation.

Root Cause

The root cause is insufficient validation of untrusted input processed by mobile-specific components before the Omnibox draws its content. Because Chrome trusts values that should have been sanitized or contextually bound to the actual navigation origin, the address bar can present a URL that does not match the resource actually loaded. This is consistent with [CWE-20] Improper Input Validation.

Attack Vector

Exploitation requires local delivery of a malicious file. An attacker crafts a file that, when opened or interacted with in Chrome on Android, triggers the flawed input path and causes the Omnibox to render an attacker-chosen URL. The resulting spoof supports phishing against banking, enterprise SSO, and webmail origins because users cannot distinguish the fake URL from a legitimate navigation. No remote network attack path is described in the advisory.

No public proof-of-concept code is available. Technical details are tracked in Chromium Issue #520407381 and the Google Chrome Releases update.

Detection Methods for CVE-2026-17860

Indicators of Compromise

Unexpected file downloads or shared files opened directly in Chrome on Android immediately before phishing-style credential prompts
User reports of Omnibox URLs that do not match the visible page content or expected destination
Chrome for Android versions below 151.0.7922.72 present in mobile device inventory

Detection Strategies

Query mobile device management (MDM) inventory for Chrome for Android build versions and flag any below 151.0.7922.72
Correlate file-open events from Android file managers or messaging apps with subsequent Chrome navigation to unfamiliar domains
Monitor enterprise phishing report queues for user-submitted screenshots showing address bar mismatches on Android

Monitoring Recommendations

Ingest Chrome browser telemetry and Android MDM compliance data into a centralized analytics platform to track patch adoption
Alert on repeated credential-entry events originating from Chrome sessions on unpatched Android builds
Track file-based delivery vectors such as messaging clients, email attachments, and sideloaded content that could stage the malicious file

How to Mitigate CVE-2026-17860

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce automatic Chrome updates on managed Android devices via MDM policy
Educate users to verify destination URLs manually and to avoid entering credentials after opening unexpected files

Patch Information

Google addressed the vulnerability in Chrome for Android 151.0.7922.72. Details are published in the Google Chrome Releases update and tracked in Chromium Issue #520407381. Applying the vendor update is the definitive remediation.

Workarounds

Restrict opening untrusted files directly in Chrome on Android until the update is deployed
Use MDM to block sideloading and constrain which applications can hand off files to Chrome
Instruct users to close and reopen Chrome, then re-navigate manually, if the Omnibox appears inconsistent with page content

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Ensure the returned versionName is >= 151.0.7922.72