CVE-2026-17980
Summary
by MITRE • 07/30/2026
Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a user interface implementation flaw in Google Chrome for Android that falls under the category of cross-origin information disclosure. The issue stems from inadequate validation of user interactions within the browser's graphical interface, specifically when handling certain UI gestures that should not be permitted across different origins. The vulnerability is classified as low severity by Chromium security standards but still presents a potential risk for data leakage between different web contexts.
The technical flaw manifests in how Chrome processes specific user interface interactions on Android devices, where an attacker can craft a malicious HTML page designed to exploit the improper handling of cross-origin gestures. When a user inadvertently performs the required UI gestures on this crafted page, the browser's interface implementation fails to properly enforce origin boundaries, potentially allowing sensitive data from one origin to be accessed or transmitted to another. This type of vulnerability typically involves race conditions or insufficient input validation in the browser's gesture recognition and processing subsystem.
The operational impact of this vulnerability is significant for users who may encounter malicious web content while browsing, particularly on Android devices where the Chrome browser is the primary means of accessing web applications. The attack requires social engineering to convince a user to perform specific UI gestures, making it less likely to occur automatically but still poses a legitimate security concern in environments where users might be targeted through phishing or other deceptive means. The cross-origin data leakage could potentially expose session tokens, personal information, or other sensitive data that should remain isolated between different web origins.
Mitigation strategies for this vulnerability include updating to Chrome version 151.0.7922.72 or later, where the UI implementation has been corrected to properly enforce origin boundaries during gesture processing. Users should also maintain awareness of suspicious website interactions and avoid engaging with untrusted content that might prompt unusual UI gestures. Organizations should ensure their mobile device management policies include regular browser updates and security monitoring to prevent exploitation of such UI-based vulnerabilities.
This vulnerability aligns with CWE-691, which addresses insufficient control flow management in web applications, and relates to ATT&CK technique T1059.007 for JavaScript-based execution. The flaw specifically involves improper input validation during user interface interaction handling, representing a common class of issues where UI components fail to properly validate or sanitize user inputs before processing cross-origin operations.