CVE-2026-17940 is a vulnerability in Google Chrome on Android affecting the Picture-in-Picture feature. The flaw stems from insufficient validation of untrusted input, allowing a remote attacker who has already compromised the renderer process to potentially escape the sandbox. Exploitation requires a crafted HTML page and a pre-compromised renderer, making it a chained attack vector. The vulnerability was patched in Chrome version 151.0.7922.72. Chromium has rated the severity as Low, though sandbox escapes carry inherent risk regardless of base severity. The issue is tracked in the Chromium bug tracker under issue 514069440. Users on Android are advised to update their Chrome browser to the latest stable release.