CVE-2026-17999: Incorrect security UI in Google Chrome
A race condition vulnerability in the PictureInPicture feature of Google Chrome on Android versions prior to 151.0.7922.72 allows a remote attacker to perform domain spoofing via a crafted HTML page. The issue is classified with low severity by Chromium security. This vulnerability affects Chrome on Android and involves incorrect security UI behavior that could mislead users about the domain they are interacting with.
AI Analysis
Technical Summary
CVE-2026-17999 is a vulnerability in Google Chrome on Android, specifically in the PictureInPicture feature, where a race condition allows a remote attacker to conduct domain spoofing through a crafted HTML page. This could cause the browser to display misleading security UI elements, potentially tricking users about the origin of content. The vulnerability is present in versions prior to 151.0.7922.72. The Chromium security team has rated this issue as low severity. No CVSS score is provided. The vendor has published an advisory linked to a stable channel update indicating a fix is available.
Potential Impact
The vulnerability allows remote attackers to spoof the domain displayed in the PictureInPicture UI on affected Chrome Android versions. This could potentially mislead users about the authenticity of the content they are viewing, increasing the risk of phishing or social engineering attacks. However, the severity is rated low, indicating limited impact or exploitability.
Mitigation Recommendations
A fix for this vulnerability is available in Google Chrome version 151.0.7922.72. Users and administrators should update affected Chrome installations on Android to this version or later to remediate the issue. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for more details.
CVE-2026-17999: Incorrect security UI in Google Chrome
Description
A race condition vulnerability in the PictureInPicture feature of Google Chrome on Android versions prior to 151.0.7922.72 allows a remote attacker to perform domain spoofing via a crafted HTML page. The issue is classified with low severity by Chromium security. This vulnerability affects Chrome on Android and involves incorrect security UI behavior that could mislead users about the domain they are interacting with.
Affected software
pkg:deb/google/chrome-androidRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17999 is a vulnerability in Google Chrome on Android, specifically in the PictureInPicture feature, where a race condition allows a remote attacker to conduct domain spoofing through a crafted HTML page. This could cause the browser to display misleading security UI elements, potentially tricking users about the origin of content. The vulnerability is present in versions prior to 151.0.7922.72. The Chromium security team has rated this issue as low severity. No CVSS score is provided. The vendor has published an advisory linked to a stable channel update indicating a fix is available.
Potential Impact
The vulnerability allows remote attackers to spoof the domain displayed in the PictureInPicture UI on affected Chrome Android versions. This could potentially mislead users about the authenticity of the content they are viewing, increasing the risk of phishing or social engineering attacks. However, the severity is rated low, indicating limited impact or exploitability.
Mitigation Recommendations
A fix for this vulnerability is available in Google Chrome version 151.0.7922.72. Users and administrators should update affected Chrome installations on Android to this version or later to remediate the issue. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for more details.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Chrome
- Date Reserved
- 2026-07-27T23:37:15.891Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html","vendor":"Google"}]
Threat ID: 6a6aa0b19c2644c7f849c07c
Added to database: 07/30/2026, 00:54:09 UTC
Last enriched: 07/30/2026, 01:23:23 UTC
Last updated: 07/30/2026, 02:01:03 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.