CVE-2026-17802 in Chrome
Summary
by MITRE • 07/30/2026
Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a significant side-channel attack vector affecting google chrome on android systems prior to version 151.0.7922.72. The flaw resides in the gpu processing pipeline where memory access patterns and timing information can be inadvertently exposed through cache behavior and execution timing differences. Attackers can craft malicious html pages that exploit these timing variations to infer sensitive data from other origins running on the same device. The vulnerability specifically impacts the graphics processing unit's memory management system where cross-origin data may be cached or accessed in ways that reveal information about the memory layout and data access patterns of other processes.
The technical implementation leverages cache timing attacks that operate at the hardware level within the gpu's memory subsystem. When chrome renders content involving gpu-accelerated operations, certain memory access patterns create observable timing variations that correlate with the presence or absence of specific data in memory caches. This creates a covert channel through which an attacker can reconstruct information about cross-origin resources by measuring these timing differences and correlating them with known data patterns. The attack exploits the fact that modern gpu architectures maintain cache coherence across different processes, allowing information leakage between otherwise isolated execution contexts.
The operational impact of this vulnerability extends beyond simple data theft to potentially enable more sophisticated attacks including credential harvesting, session hijacking, and privacy violation exploitation. An attacker could use this technique to gather sensitive information from other websites, browser tabs, or even system-level data that should remain isolated. The medium severity classification reflects the fact that while the attack requires remote code execution through a crafted webpage, it can be delivered via standard web browsing without user interaction. This vulnerability particularly affects users of mobile devices where gpu acceleration is commonly used and memory management patterns may be more predictable than in desktop environments.
The flaw aligns with several common weakness enumerations including cwe-203 information exposure through side channels and cwe-214 invocation of external process with insecure environment variables. From an attack framework perspective, this vulnerability would map to the technique of cache timing attacks within the mitre att&ck matrix under the initial access and privilege escalation categories. Mitigation strategies include implementing memory access randomization techniques, introducing timing delays to obscure cache behavior patterns, and restricting gpu-accelerated operations for cross-origin content. Browser vendors should also consider implementing more robust isolation mechanisms between different origin contexts in their gpu processing pipelines. The recommended fix involves updating chrome to version 151.0.7922.72 or later where these memory access patterns have been modified to prevent the leakage of information through cache timing variations.