The vulnerability CVE-2026-17690 affects the PDF handling in Google Chrome on Android before version 151.0.7922.72. Due to insufficient validation of untrusted input, a local attacker can craft an HTML page that causes leakage of cross-origin data. This represents a violation of the same-origin policy, potentially exposing sensitive information accessible to the browser. The vulnerability is classified under CWE-20, indicating improper input validation as the root cause. No CVSS score is available, but the Chromium security team rates it as high severity.

Successful exploitation allows a local attacker to bypass cross-origin data protections within the browser's PDF component, leading to potential leakage of sensitive information from other origins. This compromises the confidentiality of data accessible in the browser context. There are no reports of active exploitation in the wild at this time.

A fix is available in Google Chrome on Android version 151.0.7922.72 and later. Users and administrators should update to this version or newer to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the official browser update. Patch status is not explicitly confirmed in the provided data, so users should verify the vendor advisory for the latest remediation guidance.