CVE-2026-17866 is a type confusion vulnerability in the Tab component of Google Chrome on Android platforms before version 151.0.7922.72. It allows an attacker with control over the renderer process to potentially perform a sandbox escape via a specially crafted HTML page. The vulnerability was published on July 30, 2026, and is classified as medium severity by Chromium security. There is no CVSS score or explicit remediation level provided in the source data. The vendor advisory link is available but does not explicitly confirm patch status in the provided input.

If exploited, this vulnerability could allow an attacker who has already compromised the renderer process to escape the sandbox environment, potentially leading to further system compromise on affected Android devices running vulnerable Chrome versions. The impact is limited to scenarios where the renderer process is already compromised.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to the latest stable version when a fix is released. Until then, no specific mitigation actions are confirmed.