CVE-2026-17915: Google Chrome WebView XSS Vulnerability

CVE-2026-17915 Overview

CVE-2026-17915 is a user interface (UI) spoofing vulnerability in the WebView component of Google Chrome on Android. Versions of Chrome prior to 151.0.7922.72 contain an inappropriate implementation that allows a remote attacker to spoof UI elements through a crafted HTML page. The Chromium project rated the security severity as Low. Successful exploitation requires a victim to load attacker-controlled web content in a Chrome WebView on Android. The flaw enables misleading visual presentations that can facilitate phishing or social engineering attacks against mobile users.

Critical Impact
A crafted HTML page can manipulate WebView UI rendering on Android, enabling spoofed interfaces that support phishing and credential theft workflows.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Android applications embedding Chrome WebView on affected versions
Chromium-based Android browsers built on the vulnerable WebView code

Discovery Timeline

2026-07-30 - CVE-2026-17915 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17915

Vulnerability Analysis

The vulnerability resides in the WebView implementation used by Google Chrome on Android. WebView is the embedded browser component that renders web content inside Chrome and third-party Android applications. An inappropriate implementation in this component allows a remote attacker to influence how UI surfaces are drawn or overlaid when rendering attacker-controlled HTML.

Because the flaw is a UI spoofing issue rather than memory corruption, exploitation does not yield direct code execution. Instead, an attacker can present misleading visual cues that appear to originate from a trusted context. This class of issue [CWE-451: User Interface Misrepresentation of Critical Information] typically enables credential harvesting, fake security prompts, or spoofed address bar content in mobile browsing sessions.

Root Cause

The root cause is an inappropriate implementation in the Chrome WebView rendering logic on Android. The specific code path allows crafted HTML content to influence UI rendering in a way that does not accurately reflect the source or state of the underlying page. Detailed patch analysis is available through the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures an Android user to open it in Chrome or an application that embeds Chrome WebView. Once loaded, the crafted content manipulates UI elements to present a spoofed interface. The attacker can then leverage the deceptive UI to trick the user into disclosing credentials, approving actions, or trusting content that would otherwise appear untrusted. No verified proof-of-concept code has been published for this issue.

Detection Methods for CVE-2026-17915

Indicators of Compromise

User reports of Chrome or WebView-based Android applications displaying inconsistent, misaligned, or misleading address bar and dialog content
Access logs showing Android Chrome clients on versions prior to 151.0.7922.72 visiting untrusted external URLs
Phishing landing pages that render differently on Android WebView clients than on desktop browsers

Detection Strategies

Inventory managed Android devices and enumerate installed Chrome versions to identify hosts below 151.0.7922.72
Monitor mobile web gateway and DNS telemetry for connections to known phishing infrastructure targeting Android users
Correlate user-reported phishing attempts with browser user-agent strings to identify WebView-based delivery

Monitoring Recommendations

Enable centralized reporting from mobile device management (MDM) to track Chrome for Android version compliance
Alert on Android endpoints that remain on Chrome versions predating the patched release for more than one patch cycle
Review help desk tickets referencing suspicious in-app browser prompts or unexpected authentication dialogs

How to Mitigate CVE-2026-17915

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Update the Android System WebView component to the corresponding patched build
Communicate phishing awareness guidance to mobile users, emphasizing verification of URLs and prompts
Enforce Chrome version compliance policies through MDM for corporate-managed Android devices

Patch Information

Google addressed this issue in the Chrome Stable channel update announced in the Google Chrome Stable Update. Chrome for Android version 151.0.7922.72 and later contain the fix. Android System WebView is updated through the same Play Store distribution channel and should be verified independently of the Chrome browser app.

Workarounds

Restrict the use of untrusted in-app browsers by directing users to open external links in the fully updated Chrome browser
Deploy MDM policies that block installation or use of Chrome versions prior to 151.0.7922.72
Enable Google Play Protect and automatic app updates on managed Android devices to accelerate patch adoption

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Verify Android System WebView version
adb shell dumpsys package com.google.android.webview | grep versionName