CVE-2026-17999 is a race condition vulnerability (CWE-362) in the PictureInPicture functionality of Google Chrome on Android before version 151.0.7922.72. This flaw enables a remote attacker to conduct domain spoofing by exploiting a timing issue via a specially crafted HTML page. The vulnerability has a CVSS 3.1 base score of 6.5, indicating medium severity, with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact.

Successful exploitation allows an attacker to spoof domains, potentially misleading users about the origin of content or actions within the browser. This could facilitate phishing or social engineering attacks by presenting deceptive UI elements. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with PictureInPicture content from untrusted sources.