CVE-2026-17964: Google Chrome Android XSS Vulnerability

CVE-2026-17964 Overview

CVE-2026-17964 is an incorrect security UI vulnerability in Google Chrome on Android versions prior to 151.0.7922.72. The flaw allows a remote attacker to perform domain spoofing through a crafted HTML page. Chromium classifies the security severity as Low. The issue falls into the user interface confusion category, where the browser renders trust indicators or address bar content in a way that misleads users about the actual origin of a page.

Critical Impact
Attackers can spoof legitimate domains within the Chrome for Android UI, enabling convincing phishing pages that appear to originate from trusted sites.

Affected Products

Google Chrome for Android prior to 151.0.7922.72
Chromium-based mobile browsers sharing the affected UI component
Any Android device running a vulnerable Chrome build

Discovery Timeline

2026-07-30 - CVE-2026-17964 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17964

Vulnerability Analysis

The vulnerability resides in Chrome for Android's security UI, the browser surface that communicates origin and connection trust to the user. A crafted HTML page can manipulate how the browser presents domain information, causing the displayed origin to diverge from the actual page origin. This class of issue is tracked as user interface confusion and directly undermines the visual signals users rely on to make trust decisions.

Domain spoofing bugs typically abuse Unicode rendering, address bar redraw timing, overlay elements, or omnibox state transitions. The specific mechanism for CVE-2026-17964 is tracked in the Chromium Issue Tracker Entry. Google fixed the issue in the Chrome stable channel update documented in the Google Chrome Desktop Update release notes.

Root Cause

The root cause is incorrect handling within the Chrome for Android security UI code path responsible for rendering origin information. The affected component does not consistently reflect the true page origin under attacker-controlled conditions, producing a mismatch between the URL bar contents and the loaded document.

Attack Vector

Exploitation requires only that the victim visit a crafted HTML page. No privileges, credentials, or additional interaction beyond navigation are needed. Once loaded, the malicious page manipulates browser UI state so the address bar displays a spoofed domain. Attackers pair this with phishing content to harvest credentials, session tokens, or payment information.

No public proof-of-concept exploit is listed for this CVE, and it is not present in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-17964

Indicators of Compromise

Android devices with Chrome versions below 151.0.7922.72 browsing to newly registered or low-reputation domains hosting HTML content that references trusted brand names.
HTTP referrers or DNS lookups showing sequences of navigation from suspicious pages to credential entry forms on unrelated infrastructure.

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets and flag builds earlier than 151.0.7922.72.
Correlate mobile web proxy logs with threat intelligence feeds to identify visits to domains hosting spoofing kits.
Alert on user reports of address bar behavior that does not match the site being accessed.

Monitoring Recommendations

Ingest mobile browser telemetry and MDM compliance data into a centralized analytics platform to track patch status.
Monitor authentication systems for credential submissions from mobile user agents shortly after navigation to unclassified domains.
Enable phishing URL categorization on secure web gateways used by mobile devices via VPN or proxy.

How to Mitigate CVE-2026-17964

Immediate Actions Required

Update Chrome for Android to version 151.0.7922.72 or later through Google Play.
Push mandatory update policies via Mobile Device Management (MDM) for corporate-managed Android devices.
Communicate the phishing risk to users and reinforce verification of URLs before entering credentials.

Patch Information

Google addressed CVE-2026-17964 in Chrome 151.0.7922.72. Users should install the update from the Google Play Store or enable automatic updates. Enterprise administrators can enforce the minimum version through Android Enterprise policies. Full release details are available in the Google Chrome Desktop Update advisory.

Workarounds

Restrict mobile browsing to trusted sites via secure web gateway policies until patching is complete.
Require phishing-resistant authentication such as FIDO2 security keys so spoofed domains cannot harvest reusable credentials.
Deploy anti-phishing browser configurations that block newly observed domains on managed Android devices.

bash

# Verify installed Chrome version on Android via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Enforce minimum Chrome version through Android Enterprise managed configuration
# (example JSON policy pushed via EMM)
# {
#   "MinimumVersion": "151.0.7922.72",
#   "URLBlocklist": ["*"],
#   "URLAllowlist": ["https://*.corp.example.com"]
# }