CVE-2026-17664: Google Chrome Information Disclosure Flaw

CVE-2026-17664 Overview

CVE-2026-17664 is an input validation vulnerability [CWE-20] in the Loader component of Google Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leak cross-origin data by delivering a crafted HTML page to the victim. Chromium's security team rated this issue High severity. The flaw undermines the Same-Origin Policy, one of the browser's core web security boundaries, allowing sensitive data from other origins to be read by attacker-controlled code.

Critical Impact
A compromised renderer can bypass same-origin restrictions and exfiltrate cross-origin data, exposing authenticated session content, private application data, and credentials rendered in other tabs or frames.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers using the affected Loader component prior to the equivalent patch level
Embedded applications using vulnerable Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17664 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17664

Vulnerability Analysis

The vulnerability resides in Chrome's Loader, the subsystem responsible for fetching resources and enforcing origin boundaries before content is handed to the rendering pipeline. Insufficient validation of untrusted input allows a renderer process under attacker control to influence load decisions in ways that expose data belonging to a different origin. Because the Loader is trusted to attach the correct origin and CORS metadata to responses, weakness at this layer directly translates into a bypass of the Same-Origin Policy.

Exploitation is not fully remote on its own. The attacker must first compromise the renderer process, typically by chaining this issue with a separate memory-corruption or type-confusion bug. Once inside the sandboxed renderer, the attacker uses a crafted HTML page to trigger the flawed loader path and read cross-origin responses. The Exploit Prediction Scoring System (EPSS) currently reports low near-term exploitation probability.

Root Cause

The root cause is improper input validation [CWE-20] in the Loader's handling of request or response attributes. Trust boundaries between the renderer and the network stack are not adequately enforced, allowing renderer-supplied values to shape loading behavior in unintended ways.

Attack Vector

The attack requires a two-stage chain. The attacker first gains code execution in the renderer, then serves or navigates the victim to a crafted HTML page that triggers the Loader flaw. The result is disclosure of cross-origin resources such as authenticated API responses, HTML content from other sites, or tokens embedded in third-party pages.

No verified proof-of-concept code has been published. See the Chromium Issue Tracker Entry for maintainer-side details as they become public.

Detection Methods for CVE-2026-17664

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 after the patch release window
Renderer processes generating unexpected cross-origin fetch traffic to sensitive internal endpoints
Outbound HTTP requests carrying response bodies or tokens that originated in unrelated browser tabs

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag anything below 151.0.7922.72.
Correlate browser process telemetry with network egress to identify renderers exfiltrating cross-origin content to attacker infrastructure.
Alert on renderer child processes spawning or communicating in patterns consistent with prior renderer compromise, which is the prerequisite for this bug.

Monitoring Recommendations

Monitor endpoint update compliance for Chrome and enforce automatic browser updates through management policy.
Track outbound web traffic for anomalous data volumes originating from browser processes to newly registered or low-reputation domains.
Capture browser process and network telemetry into a central data lake for retrospective hunting once additional indicators are published.

How to Mitigate CVE-2026-17664

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Update Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi once vendor builds incorporating the fix ship.
Restart browser sessions after patching to ensure the vulnerable Loader code is unloaded from memory.
Prioritize patching for users who handle sensitive web applications, administrative consoles, or authenticated SaaS content.

Patch Information

Google released the fix in the stable channel update documented at the Google Chrome Update. Users should confirm they are running 151.0.7922.72 or later by opening chrome://settings/help. Enterprise administrators can enforce the update through Chrome Browser Cloud Management or existing endpoint management tooling.

Workarounds

No official workaround eliminates the vulnerability; patching is the supported remediation path.
Reduce attack surface by restricting untrusted browsing through site isolation policies and enterprise URL allowlists.
Enable strict site isolation (--site-per-process) if not already enforced, which raises the cost of chaining a renderer compromise to this flaw.

bash

# Verify installed Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: check version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy to enforce automatic updates (Linux example)
cat >/etc/opt/chrome/policies/managed/update_policy.json <<'EOF'
{
  "UpdateDefault": 1,
  "TargetVersionPrefix": "151."
}
EOF