CVE-2026-17860 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical issue in Google Chrome's mobile browser implementation on Android platforms where insufficient input validation allows for malicious manipulation of the user interface. The flaw specifically affects versions prior to 151.0.7922.72 and enables local attackers to craft malicious files that can spoof the contents displayed in the Omnibox, which is the URL bar interface element that users rely upon for verifying website authenticity and navigation context. The vulnerability stems from inadequate sanitization of untrusted input sources within the browser's mobile rendering engine, creating a pathway for attackers to inject deceptive content into the user's browsing experience.
The technical nature of this flaw aligns with CWE-20, which addresses "Improper Input Validation" in software systems where developers fail to properly validate or sanitize data from external sources. This vulnerability operates at the intersection of user interface manipulation and input processing, allowing attackers to exploit the trust relationship between users and the browser's visual indicators. When a malicious file is processed by the browser, it can cause the Omnibox to display misleading information that appears legitimate to end users, potentially facilitating phishing attacks or other social engineering schemes. The attack vector specifically leverages local file access capabilities where an attacker with physical access to the device or the ability to deliver malicious files through other means can manipulate how URLs are presented.
The operational impact of this vulnerability extends beyond simple visual deception to create significant security risks for users conducting online transactions, accessing sensitive information, or performing authentication processes. Users may be misled into believing they are visiting legitimate websites when in fact they are interacting with spoofed interfaces that could capture credentials or personal data. This vulnerability particularly affects mobile browsing environments where users often have less sophisticated security awareness compared to desktop users and where the visual cues provided by the browser's interface serve as primary indicators of website legitimacy. The medium severity classification according to Chromium security standards reflects the potential for abuse in real-world scenarios while acknowledging that the attack requires local access or file delivery capabilities.
Mitigation strategies should focus on implementing robust input validation mechanisms within the browser's mobile rendering components and ensuring proper sandboxing of file processing operations. System administrators and security teams should prioritize immediate patch deployment to affected Chrome versions and consider implementing additional monitoring for suspicious file access patterns. Users should be educated about the importance of verifying website URLs through multiple means beyond visual indicators and maintain updated browser versions to prevent exploitation. The vulnerability highlights the critical importance of maintaining comprehensive input validation across all application components, particularly those that directly interface with user perception and trust mechanisms. Organizations should also consider implementing network-level protections and file access controls to limit potential attack surfaces for local privilege escalation scenarios that could exploit this vulnerability.