CVE-2026-17984: Chrome Android Information Disclosure Bug

CVE-2026-17984 Overview

CVE-2026-17984 is an inappropriate implementation vulnerability in the Browser component of Google Chrome on Android. The flaw affects versions prior to 151.0.7922.72 and allows a local attacker to leak cross-origin data via a crafted HTML page. Google classified the Chromium security severity as Low.

The issue undermines the same-origin policy on Android builds of Chrome, exposing data that should remain isolated between web origins. Successful exploitation requires the target to render an attacker-controlled HTML page in a vulnerable Chrome for Android build.

Critical Impact
A crafted HTML page can leak cross-origin data on Android Chrome versions prior to 151.0.7922.72, breaking web origin isolation guarantees.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based browsers on Android that share the vulnerable Browser component
Embedded Android applications using affected Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17984 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17984

Vulnerability Analysis

CVE-2026-17984 stems from an inappropriate implementation in the Chrome Browser process on Android. The defect enables a crafted HTML page to observe or extract data belonging to a different origin. This bypasses the same-origin policy that browsers rely on to isolate content between sites.

The vulnerability is categorized as an information disclosure issue affecting cross-origin isolation. Google's Chromium team assigned it a Low severity rating, indicating limited scope or constrained preconditions for exploitation. The attack vector is described as local, meaning the attacker must induce the victim to load malicious content within the vulnerable browser.

Root Cause

The root cause lies in how the Browser component handles data flows across origins on the Android platform. Public technical details remain limited pending broader patch adoption. The Chromium Issue Tracker entry is referenced by Google's advisory and contains the internal defect record.

Attack Vector

An attacker crafts an HTML page designed to trigger the flawed cross-origin handling behavior. When a user on a vulnerable Chrome for Android build loads that page, the browser leaks data associated with a different origin. Delivery typically occurs through direct navigation, links, or embedded content such as iframes.

No verified proof-of-concept or exploit code has been published. The vulnerability is described in prose in Google's advisory without accompanying technical write-up. Refer to the Google Chrome release note for the official disclosure.

Detection Methods for CVE-2026-17984

Indicators of Compromise

Android Chrome clients reporting versions earlier than 151.0.7922.72 in user-agent telemetry
Unexpected cross-origin resource reads or referrer patterns originating from mobile Chrome sessions
Navigation events to unfamiliar HTML pages immediately preceding suspicious outbound requests

Detection Strategies

Inventory browser versions across managed Android endpoints and flag installs below 151.0.7922.72
Inspect web proxy and DNS logs for user agents indicating outdated Chrome for Android builds
Correlate mobile browsing telemetry with threat intelligence feeds tracking malicious HTML delivery infrastructure

Monitoring Recommendations

Enable enterprise browser reporting through Chrome Enterprise Core to surface version drift on Android fleets
Monitor mobile device management (MDM) compliance dashboards for outdated Chrome installations
Alert on anomalous cross-origin request volumes from mobile clients that may indicate data leakage attempts

How to Mitigate CVE-2026-17984

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Push the update via MDM to all managed Android devices to enforce compliance
Advise users to avoid opening untrusted links in Chrome on Android until the update is confirmed installed

Patch Information

Google addressed the issue in Chrome 151.0.7922.72 on Android. Details are published in the Chrome Releases blog. Users receive the update automatically through Google Play, though enterprise-managed devices may require an MDM-driven rollout.

Workarounds

Restrict browsing on unpatched Android devices to trusted sites via MDM URL allow-lists
Deploy an alternative patched browser on Android endpoints until Chrome can be updated
Enforce Chrome auto-update policies through Android Enterprise configuration profiles

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for a patched device:
# versionName=151.0.7922.72