CVE-2026-17980 Overview
CVE-2026-17980 is an inappropriate implementation flaw in the user interface (UI) of Google Chrome on Android. The vulnerability affects Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by hosting a crafted HTML page and convincing a user to perform specific UI gestures on the page. Google's Chromium project rated the security severity as Low. The issue falls into the category of user interface confusion combined with information disclosure across origins.
Critical Impact
Successful exploitation leaks cross-origin data from a targeted user's browser session, breaking the same-origin policy through a crafted page and required user interaction.
Affected Products
- Google Chrome on Android prior to 151.0.7922.72
- Chromium-based mobile browsers on Android that share the affected UI code path
- Downstream Android WebView or embedded browser components tracking the same Chromium release channel
Discovery Timeline
- 2026-07-30 - CVE-2026-17980 published to the National Vulnerability Database
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17980
Vulnerability Analysis
The vulnerability resides in Chrome's Android UI layer. Chrome renders content from many origins, and the browser UI must strictly separate what one origin can observe from another. An inappropriate implementation in the UI code path allows a crafted HTML page to influence what the browser reveals to the attacker-controlled origin. The result is a cross-origin data leak triggered through user gestures.
Exploitation is not fully automatic. The attacker must convince the user to perform specific UI gestures on the malicious page. This gesture requirement raises the interaction bar but is achievable through common social engineering patterns such as fake prompts, games, or clickjacking-style overlays. Chromium classified this issue as Low severity, consistent with a gesture-gated information disclosure rather than direct code execution. Full technical details are tracked in Chromium Issue #519710361.
Root Cause
The root cause is an implementation error in Chrome's Android UI that fails to enforce cross-origin boundaries when the user performs certain gestures. UI elements or rendering behavior expose data belonging to an origin other than the one the user is interacting with. This category of defect maps to user interface confusion leading to information disclosure.
Attack Vector
The attack vector is remote and web-based. The attacker delivers a crafted HTML page, typically by directing the victim to an attacker-controlled URL or embedding the payload in a page the victim already visits. The victim must engage in specific UI gestures for the leak to occur. See the Chrome Blog Update for the vendor announcement.
No verified proof-of-concept code is publicly available.
Refer to Chromium Issue #519710361 for restricted technical details.
Detection Methods for CVE-2026-17980
Indicators of Compromise
- Android devices running Google Chrome versions earlier than 151.0.7922.72 are exposed and should be treated as at-risk endpoints.
- Browser navigation logs showing user visits to unfamiliar HTML pages that request unusual gesture interactions such as long-press sequences, drag operations, or repeated taps on overlays.
- Outbound HTTP requests from mobile devices carrying data fields that appear to correspond to content from other origins the user recently visited.
Detection Strategies
- Inventory Chrome browser versions across managed Android fleets using mobile device management (MDM) telemetry and flag installations below 151.0.7922.72.
- Correlate web proxy or DNS logs with newly reported malicious domains distributing gesture-based social engineering pages.
- Review browser crash and telemetry reports from Android endpoints for anomalies referencing the Chrome UI subsystem tracked in Chromium Issue #519710361.
Monitoring Recommendations
- Monitor mobile web gateway logs for pages that combine cross-origin iframes with prompts to perform specific gestures.
- Track Chrome version drift on Android devices and alert when devices remain on pre-151 builds beyond the patch window.
- Watch identity and session telemetry for anomalous cross-origin data appearing in requests to attacker-controlled infrastructure.
How to Mitigate CVE-2026-17980
Immediate Actions Required
- Update Google Chrome on all Android devices to version 151.0.7922.72 or later through the Google Play Store.
- Enforce minimum Chrome version policies through MDM to prevent users from remaining on vulnerable builds.
- Communicate guidance to users to avoid performing unusual gesture sequences requested by unfamiliar web pages.
Patch Information
Google addressed CVE-2026-17980 in Chrome for Android 151.0.7922.72. The fix is delivered through the Chrome Stable channel and referenced in the Chrome Blog Update. Chromium tracks the underlying defect in Chromium Issue #519710361, which may remain restricted until the majority of users have updated.
Workarounds
- Restrict browsing on unmanaged or unpatched Android devices to trusted sites until the Chrome update is applied.
- Use MDM policies to require automatic updates for Chrome on Android and disable side-loaded browser variants.
- Deploy web filtering to block known malicious domains that host social engineering pages soliciting user gestures.
# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 151.0.7922.72 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
