CVE-2026-17999: Google Chrome Race Condition Vulnerability

CVE-2026-17999 Overview

CVE-2026-17999 is a race condition in the Picture-in-Picture (PiP) component of Google Chrome on Android. The flaw affects versions prior to 151.0.7922.72 and allows a remote attacker to perform domain spoofing through a crafted HTML page. Google's Chromium security team rated the underlying issue as Low severity.

A successful attack tricks the user into trusting content that appears to originate from a legitimate domain. This creates a foundation for phishing, credential theft, and social engineering against mobile Chrome users.

Critical Impact
A remote attacker can spoof the displayed origin during Picture-in-Picture playback, undermining the trust boundary that users rely on to verify site identity in the mobile browser.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based Android browsers embedding vulnerable Picture-in-Picture code
Android WebView components sharing the affected PiP implementation

Discovery Timeline

2026-07-30 - CVE-2026-17999 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17999

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] in Chrome's Picture-in-Picture implementation on Android. Concurrent operations in the PiP window handling permit an attacker-controlled sequence to observe a security-relevant state before it is fully committed. The result is a mismatch between the PiP window's displayed origin and the actual content source.

Domain spoofing arises because the origin indicator does not reliably reflect the frame or document that owns the PiP media surface. An attacker with a crafted HTML page can win the race between navigation state updates and PiP window rendering. The victim then sees a legitimate-looking origin while interacting with attacker-controlled content.

Mobile browser UI already presents a compressed security surface, so origin spoofing in this context is impactful for phishing. Chromium's rating of Low reflects the constrained impact on confidentiality and integrity rather than ease of exploitation.

Root Cause

The root cause is insufficient synchronization between Picture-in-Picture window lifecycle events and the origin state tracked by the browser. The PiP subsystem consumes state that can be mutated concurrently by page navigation or scripted media control. Without atomic sequencing, the display can present a stale or attacker-selected origin.

Attack Vector

Exploitation requires a user to visit or be redirected to a crafted HTML page under attacker control. The page invokes Picture-in-Picture APIs while triggering the race window to substitute a spoofed origin. No memory corruption is achieved; the outcome is user-facing deception. See the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor detail.

No verified public exploit code is available. The vulnerability is described in prose only, per available references.

Detection Methods for CVE-2026-17999

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72 still in production use
Outbound requests from mobile Chrome to newly registered or low-reputation domains hosting HTML that programmatically invokes Picture-in-Picture
User reports of credential prompts or login pages appearing inside or beside a PiP video window

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag installations below 151.0.7922.72
Correlate mobile web proxy logs for pages that call the Picture-in-Picture API against threat intelligence for phishing infrastructure
Hunt for credential submissions from mobile Chrome sessions to domains that do not match the visually asserted origin

Monitoring Recommendations

Alert on Android Chrome user-agent strings reporting builds prior to the fixed version through MDM or web analytics
Monitor phishing report queues for mobile-specific artifacts referencing PiP or floating video overlays
Track help-desk tickets involving suspicious login pages triggered from video playback on Android

How to Mitigate CVE-2026-17999

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through Google Play
Push the update via mobile device management (MDM) to all managed Android endpoints
Notify users to avoid entering credentials while a Picture-in-Picture window is active until patching is confirmed

Patch Information

Google addressed the issue in Chrome for Android 151.0.7922.72. Details are published in the Google Chrome Update Announcement, with tracking in the Chromium Issue Tracker Entry.

Workarounds

Restrict use of Picture-in-Picture on managed Android devices via enterprise policy until updates are deployed
Enforce Safe Browsing and phishing protection settings in Chrome for Android through MDM
Train mobile users to verify the address bar rather than any origin string shown adjacent to a PiP window

bash

# Verify Chrome for Android version on a managed device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show 151.0.7922.72 or later