CVE-2026-17940 is a security vulnerability in Google Chrome on Android affecting versions before 151.0.7922.72. It arises from insufficient validation of untrusted input within the Picture-in-Picture functionality. An attacker with control over the renderer process could leverage this flaw to attempt a sandbox escape via a specially crafted HTML page. The issue has been publicly disclosed but lacks a CVSS score and detailed remediation level. The vendor advisory linked corresponds to a stable channel update announcement, but explicit patch status is not confirmed in the provided data.

The vulnerability could enable a remote attacker who has compromised the renderer process to escape the sandbox environment, potentially leading to increased privileges or further compromise on the affected device. However, the severity is considered low, and no exploits are currently known in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to the latest stable version once a fix is confirmed. No specific temporary mitigations are provided in the available data.