Google Chrome on Android PDF Insufficient Validation Vulnerability (CVE-2026-17690) – High -DC-Aug2026-1239

CVE-2026-17690 is a security flaw in Google Chrome on Android that stems from insufficient validation of untrusted input within the browser’s built‑in PDF rendering engine. The vulnerability affects all Chrome for Android versions prior to 151.0.7922.72 and is classified by Chromium with a security severity of High .
At its core, the issue lies in how Chrome’s PDF component processes malformed or specially crafted content embedded in a web page. When a user visits an attacker‑controlled HTML page, that page can invoke the PDF viewer with a manipulated payload. Because the PDF parser does not thoroughly validate certain inputs—such as embedded JavaScript, external resource references, or cross‑origin requests—it can be tricked into disclosing data that belongs to a different origin (i.e., a different website or local resource) .
The attack is local in nature, meaning the attacker must entice the victim to open a malicious HTML page on their Android device. This can be achieved through phishing links, malicious advertisements, or compromised websites. Once the page is loaded, the PDF viewer processes the attacker’s input without proper sanitisation, allowing the extraction of sensitive information such as authentication tokens, personal data, or other cross‑origin resources that the browser has cached or has access to .
The vulnerability is rooted in CWE‑20 (Improper Input Validation) . The PDF component fails to distinguish between trusted and untrusted data streams, enabling an attacker to bypass the same‑origin policy—a fundamental security mechanism that prevents one origin from reading data from another. By leaking cross‑origin data, the attacker can harvest information that should be isolated, potentially leading to session hijacking, credential theft, or further lateral movement within the user’s authenticated sessions.
The Chromium security team addressed the issue by tightening input validation routines in the PDF parser and enforcing stricter origin checks when rendering PDF content inside a web context. The fix was backported to Chrome 151.0.7922.72 for Android, and users are strongly advised to update immediately .
The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N` . Although the overall score is Medium, the Chromium project rates it as High due to the practical ease of exploitation and the potential for significant data exposure. The EPSS (Exploit Prediction Scoring System) probability is currently estimated at 0.29% (21st percentile), indicating a moderate likelihood of exploitation in the wild .

DailyCVE Form:

Platform: ……. Android
Version: …….. prior 151.0.7922.72
Vulnerability :…… improper input validation
Severity: ……. High (Chromium)
date: ………. 30 July 2026

Prediction: ……. 03 August 2026

Analytics – What Undercode Say

The following Bash commands and code snippets can be used to audit, detect, or simulate the vulnerability in a controlled environment.

Check installed Chrome version on Android (via ADB)
adb shell dumpsys package com.android.chrome | grep versionName
Compare against the fixed version
FIXED_VERSION="151.0.7922.72"
INSTALLED_VERSION=$(adb shell dumpsys package com.android.chrome | grep versionName | cut -d'=' -f2)
if [[ "$INSTALLED_VERSION" < "$FIXED_VERSION" ]]; then
echo "Vulnerable to CVE-2026-17690"
else
echo "Patched"
fi

Query the NVD API for CVE-2026-17690 details
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-17690" | jq '.'

// Proof-of-concept HTML snippet (for educational purposes only)
// Attempts to trigger the PDF parser with a cross-origin payload
const iframe = document.createElement('iframe');
iframe.src = 'data:application/pdf;base64,JVBERi0xLjQK...'; // malformed PDF
iframe.onload = () => {
// Attempt to read cross-origin data via postMessage or other channels
console.log('PDF loaded, potential leak surface');
};
document.body.appendChild(iframe);

Exploit

An attacker crafts a malicious HTML page that includes a specially constructed PDF embedded as a data URI or loaded via an `