Description
Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Published: 2026-07-30
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability arises from insufficient validation of untrusted input in PDF viewing on Android Chrome versions prior to 151.0.7922.72. A local attacker could construct a crafted HTML page that triggers the PDF component, causing Chrome to expose cross‑origin data. The flaw permits an attacker to read any data that would otherwise be protected by same‑origin policy, effectively a local data leak. The weakness is an input validation issue (CWE‑20, CWE‑346).

Affected Systems

Google Chrome running on Android devices, specifically versions before 151.0.7922.72. The issue is present in all builds of the stable channel for Android that include the embedded PDF renderer.

Risk and Exploitability

The CVSS score of 6.5 classifies the impact as moderate. The EPSS score is below 1 %, indicating exploitation is expected to be rare. The flaw is not listed in CISA KEV. Attacks require a local user to open a crafted HTML page that contains an embedded PDF; the PDF viewer then yields cross‑origin data, so the attack vector is local access via a user‑initiated action. No remote code execution is provided by this flaw.

Generated by OpenCVE AI on August 3, 2026 at 12:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Google Chrome on Android to version 151.0.7922.72 or later.
  • Disable or restrict the use of the native PDF viewer through enterprise policies or settings if the device cannot be updated immediately.
  • Monitor Google's release notes and apply subsequent security patches promptly.

Generated by OpenCVE AI on August 3, 2026 at 12:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History

Thu, 30 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Thu, 30 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title chromium-browser: chromium-browser: Insufficient validation of untrusted input in PDF
Weaknesses CWE-346
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N'}

threat_severity

Important

Thu, 30 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Thu, 30 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-20
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-07-30T15:13:36.772Z

Reserved: 2026-07-27T23:34:23.593Z

Link: CVE-2026-17690

cve-icon Vulnrichment

Updated: 2026-07-30T15:13:29.309Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-30T01:16:31.333

Modified: 2026-08-03T12:15:04.090

Link: CVE-2026-17690

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-30T00:18:54Z

Links: CVE-2026-17690 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T12:45:03Z

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-346

    Origin Validation Error