CVE-2026-17794 describes an insufficient validation vulnerability in the mobile version of Google Chrome on Android before 151.0.7922.72. An attacker who has already compromised the renderer process can exploit this flaw to spoof the Omnibox, misleading users about the URL they are visiting by crafting malicious HTML content. This vulnerability is related to CWE-20 (Improper Input Validation). No CVSS score is available, and no known exploits in the wild have been reported.

The vulnerability allows an attacker with renderer process control to spoof the URL bar, potentially misleading users about the authenticity of the website they are visiting. This can facilitate phishing or social engineering attacks by making malicious sites appear legitimate. However, exploitation requires prior compromise of the renderer process.

A fix is available in Google Chrome for Android version 151.0.7922.72 and later. Users and administrators should update to this version or newer to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official patch. No additional mitigation guidance is provided.