CVE-2026-17940 is a vulnerability in Google Chrome on Android affecting versions before 151.0.7922.72. It arises from insufficient validation of untrusted input within the Picture-in-Picture functionality. An attacker with control over the renderer process could leverage this flaw to attempt a sandbox escape via a specially crafted HTML page. The Chromium security team rates this vulnerability as low severity. There is no CVSS score or detailed vendor advisory provided in the input data, and no known exploits have been reported.

The vulnerability allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox environment, which could lead to increased privileges or further compromise of the system. However, the severity is considered low, indicating limited impact or difficulty in exploitation. No evidence of active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch information or official fix details are provided, users should monitor official Google Chrome security advisories for updates. Until a fix is confirmed, limiting exposure to untrusted content and maintaining updated software is advisable.