This vulnerability in Google Chrome on Android versions before 151.0.7922.72 arises from insufficient validation of untrusted input within the Web Authentication feature. An attacker who has already compromised the renderer process could exploit this flaw by delivering a specially crafted HTML page, potentially enabling a sandbox escape. This could lead to elevated privileges and further compromise of the device. The issue is tracked as CVE-2026-17681 and has been assigned a critical severity rating with a CVSS 3.1 base score of 9.6.

Successful exploitation could allow a remote attacker with control over the renderer process to escape the sandbox environment, leading to full compromise of the affected device. This impacts confidentiality, integrity, and availability of the system, as indicated by the CVSS vector. There are no known exploits in the wild at this time.

A fix is available in Google Chrome version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory linked confirms the availability of this update. No additional mitigation steps are specified beyond applying the official update.