CVE-2026-17872: Cryptographic Flaw in Google Chrome
A cryptographic flaw in the WebAppInstalls component of Google Chrome on Android versions prior to 151.0.7922.72 allows a local attacker to potentially escape the sandbox by using a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 6.1. No confirmed exploits in the wild have been reported. The vendor advisory linked does not explicitly state the availability of a patch or remediation status.
AI Analysis
Technical Summary
CVE-2026-17872 is a medium severity vulnerability in Google Chrome on Android involving a cryptographic flaw in the WebAppInstalls feature. This flaw could allow a local attacker to perform a sandbox escape by crafting a malicious HTML page. The CVSS vector indicates the attack requires local access, low attack complexity, no privileges, and user interaction, with impacts on confidentiality, integrity, and availability. The vulnerability is identified as CWE-347 (Improper Verification of Cryptographic Signature). The affected versions are those prior to 151.0.7922.72. The vendor advisory linked does not explicitly confirm patch availability or remediation details.
Potential Impact
If exploited, this vulnerability could allow a local attacker to escape the sandbox environment in Chrome on Android, potentially leading to unauthorized access or control beyond the browser sandbox. The impact affects confidentiality, integrity, and availability to a limited extent. No active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update blog does not explicitly confirm a fix for this vulnerability. Users should monitor official Google Chrome release notes and update to version 151.0.7922.72 or later once confirmed.
CVE-2026-17872: Cryptographic Flaw in Google Chrome
Description
A cryptographic flaw in the WebAppInstalls component of Google Chrome on Android versions prior to 151.0.7922.72 allows a local attacker to potentially escape the sandbox by using a crafted HTML page. The vulnerability has a medium severity rating and a CVSS score of 6.1. No confirmed exploits in the wild have been reported. The vendor advisory linked does not explicitly state the availability of a patch or remediation status.
CVSS v3.1
Score 6.1medium
Affected software
Chrome
pkg:github/chromium/chromiumRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17872 is a medium severity vulnerability in Google Chrome on Android involving a cryptographic flaw in the WebAppInstalls feature. This flaw could allow a local attacker to perform a sandbox escape by crafting a malicious HTML page. The CVSS vector indicates the attack requires local access, low attack complexity, no privileges, and user interaction, with impacts on confidentiality, integrity, and availability. The vulnerability is identified as CWE-347 (Improper Verification of Cryptographic Signature). The affected versions are those prior to 151.0.7922.72. The vendor advisory linked does not explicitly confirm patch availability or remediation details.
Potential Impact
If exploited, this vulnerability could allow a local attacker to escape the sandbox environment in Chrome on Android, potentially leading to unauthorized access or control beyond the browser sandbox. The impact affects confidentiality, integrity, and availability to a limited extent. No active exploitation has been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The linked Google Chrome stable channel update blog does not explicitly confirm a fix for this vulnerability. Users should monitor official Google Chrome release notes and update to version 151.0.7922.72 or later once confirmed.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-07-27T23:35:08.977Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html","vendor":"Google"}]
Threat ID: 6a6aa09e9c2644c7f849b7c2
Added to database: 07/30/2026, 00:53:50 UTC
Last enriched: 08/06/2026, 17:14:29 UTC
Last updated: 09/12/2026, 16:30:01 UTC
Views: 45
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.