CVE-2026-17793

chromium-browser: chromium-browser: Inappropriate implementation in Messages

View on CVE.org
Published Jul 30, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Description
Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Analysis

AI-generated

Technical impact

An inappropriate implementation in the Messages component of Google Chrome for Android allows a remote attacker to persuade users that a maliciously crafted HTML page is part of the legitimate browser UI. The flaw, classified as CWE-1021 and CWE-451, permits UI spoofing that can deceive users into divulging credentials or engaging with content that compromises confidentiality or integrity. The impact is limited to deception and social engineering rather than direct code execution.

Affected Systems

This vulnerability affects Google Chrome for Android versions before 151.0.7922.72. Users who have not upgraded to the latest stable release, 151.0.7922.72 or newer, are at risk.

Risk and Exploitability

The CVSS score of 6.5 reflects a medium severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the current environment. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, crafted HTML page that the user must load in the browser, making widespread exploitation difficult but still possible if users visit malicious sites.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Chrome for Android to version 151.0.7922.72 or later.
  • If an upgrade is delayed, block or disable the Messages component via enterprise policy or developer options.
  • Deploy anti‑phishing tools and conduct user training to verify site authenticity before entering sensitive data.

Generated by OpenCVE AI on August 3, 2026 at 12:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4710-1 chromium security update
Debian DSA Debian DSA DSA-6408-1 chromium security update
History
Type Values Removed Values Added
Weaknesses CWE-451
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'}
Type Values Removed Values Added
Title chromium-browser: chromium-browser: Inappropriate implementation in Messages
Weaknesses CWE-1021
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}

threat_severity

Moderate
Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome
Type Values Removed Values Added
Description Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
References
Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames

  • CWE-451

    User Interface (UI) Misrepresentation of Critical Information

Sources

Status
PUBLISHED
Assigner
Chrome
Published
Updated
Jul 31, 2026, 4:12 PM
Reserved
Jul 27, 2026, 11:34 PM

View source JSON

Updated
Jul 31, 2026, 4:11 PM

JSON

Status
Analyzed
Published
Jul 30, 2026, 1:16 AM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

Severity
Moderate
Public date
Jul 30, 2026, 12:19 AM

View source Bugzilla JSON

Updated
Aug 3, 2026, 12:15 PM

JSON