CVE-2026-17999 in Chrome
Summary
by MITRE • 07/30/2026
Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability involves a race condition within the PictureInPicture functionality of Google Chrome on Android systems, specifically affecting versions prior to 151.0.7922.72. The flaw occurs when the browser processes HTML pages that attempt to manipulate the PictureInPicture mode through JavaScript APIs, creating a temporal window where the user interface can be manipulated before proper validation occurs. The race condition stems from insufficient synchronization mechanisms between the rendering engine and the PictureInPicture API implementation, allowing malicious actors to exploit this timing gap during page transitions.
The technical implementation of this vulnerability leverages the inherent timing discrepancies in how Chrome handles PictureInPicture mode activation and UI updates. When a crafted HTML page triggers PictureInPicture functionality, the browser's internal state management does not properly synchronize the display update with the underlying security checks. This creates an opportunity for attackers to inject malicious content or modify the displayed URL context during the brief period when the interface is transitioning between normal browsing and PictureInPicture mode. The flaw falls under CWE-362 which specifically addresses race conditions in software implementations where multiple threads or processes access shared resources without proper synchronization.
The operational impact of this vulnerability enables remote attackers to perform domain spoofing attacks, where users might be misled into believing they are visiting a legitimate website when actually interacting with a malicious one. This type of attack exploits the user's trust in the browser interface and can lead to phishing attempts, credential theft, or other malicious activities. Users who engage with PictureInPicture functionality on vulnerable Chrome versions may unknowingly interact with spoofed domains that appear legitimate due to the interface manipulation.
From an ATT&CK framework perspective, this vulnerability maps to techniques involving social engineering through user interface manipulation and deception. The attack vector aligns with T1566 which covers credential harvesting through social engineering, particularly when combined with T1071 which addresses application layer protocol usage. The security implications extend beyond simple domain spoofing as this could serve as a stepping stone for more complex attacks requiring user trust establishment. Organizations should consider the broader threat landscape where such UI manipulation vulnerabilities can enable subsequent exploitation paths.
Mitigation strategies include immediate upgrade to Chrome version 151.0.7922.72 or later, which implements proper synchronization mechanisms and race condition handling in the PictureInPicture API. Administrators should also implement network-level monitoring to detect unusual PictureInPicture mode usage patterns that might indicate exploitation attempts. Browser security policies should be reviewed to ensure appropriate restrictions on PictureInPicture functionality in high-risk environments. Additionally, user education regarding suspicious interface behavior during PictureInPicture operations can help reduce successful exploitation rates, though this remains a secondary defense given the technical nature of the vulnerability.