CVE-2026-17666 Overview
CVE-2026-17666 is a cryptographic flaw in the Enterprise component of Google Chrome affecting versions prior to 151.0.7922.72. An attacker in a privileged network position can bypass discretionary access control by injecting or manipulating malicious network traffic. Chromium security engineers rated the severity as High. The flaw does not require code execution on the target host, but it does require the adversary to sit on the network path between the Chrome client and the endpoint it communicates with. Google addressed the issue in the Stable channel release published on the Google Chrome Update Announcement.
Critical Impact
A network-adjacent attacker can defeat discretionary access controls enforced by Chrome Enterprise, undermining trust boundaries that gate access to internal resources.
Affected Products
- Google Chrome (Enterprise) prior to 151.0.7922.72
- Chromium-based browsers that inherit the affected cryptographic component
- Managed Chrome Enterprise deployments running vulnerable builds
Discovery Timeline
- 2026-07-30 - CVE-2026-17666 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17666
Vulnerability Analysis
The vulnerability resides in a cryptographic routine used by Chrome's Enterprise features. The routine fails to properly enforce integrity or authentication guarantees on network-delivered material. As a result, an attacker who can observe or modify traffic between the browser and a server can influence access decisions that Chrome would otherwise reject.
Discretionary access control (DAC) checks in this context govern how Chrome grants access to enterprise-managed resources, policies, or credentials. When the cryptographic verification step is bypassed, the browser accepts attacker-influenced state as authoritative. The Chromium team classified the severity as High, and further engineering context is tracked in the Chromium Issue Tracker Entry.
Root Cause
The root cause is a defect in cryptographic validation logic within the Enterprise code path. The affected routine did not correctly bind protected material to the identity or authorization context expected by the access-control layer. Weak or missing verification allowed malicious network traffic to substitute or manipulate values that Chrome treated as trusted.
Attack Vector
Exploitation requires an adjacent network position such as a compromised proxy, on-path device, malicious Wi-Fi, or a rogue internal host performing ARP or DNS manipulation. The attacker crafts or modifies network traffic destined for Chrome Enterprise clients. Because the cryptographic check is defective, the tampered traffic is accepted, and the DAC boundary is bypassed. User interaction is not required beyond normal browser use. No verified proof-of-concept is publicly available at the time of publication, and the EPSS data indicates a low near-term exploitation probability.
Detection Methods for CVE-2026-17666
Indicators of Compromise
- Chrome Enterprise clients running versions earlier than 151.0.7922.72 in fleet inventory reports.
- Unexpected TLS negotiation anomalies or certificate substitutions on paths used by managed Chrome installations.
- Access to enterprise-gated resources from endpoints that should not have satisfied policy checks.
Detection Strategies
- Inventory managed Chrome deployments and flag any browser version below 151.0.7922.72.
- Correlate authentication or policy decisions with the Chrome build reported by the endpoint to surface stale versions granting access.
- Monitor for on-path indicators such as gratuitous ARP, unexpected proxy insertion, or unauthorized TLS interception on enterprise segments.
Monitoring Recommendations
- Enable Chrome Enterprise reporting to a centralized log store and alert on version drift.
- Baseline network telemetry between managed clients and enterprise services so that new intermediaries are flagged quickly.
- Track Google's Stable channel update notices and align patch verification jobs with each release.
How to Mitigate CVE-2026-17666
Immediate Actions Required
- Update all Chrome Enterprise installations to version 151.0.7922.72 or later.
- Force a restart of Chrome across the fleet to ensure the patched binary is loaded.
- Audit any access-control decisions made by managed Chrome clients running vulnerable versions during the exposure window.
Patch Information
Google released the fix in Chrome Stable 151.0.7922.72. Administrators should distribute the update through their existing Chrome Enterprise management channel, group policy, or MDM. Refer to the Google Chrome Update Announcement for release details and the Chromium Issue Tracker Entry for engineering context.
Workarounds
- Restrict Chrome Enterprise clients to trusted network segments until the update is deployed.
- Enforce strict TLS validation and certificate pinning on enterprise services accessed by Chrome.
- Require VPN or mutually authenticated tunnels for access to sensitive resources so that on-path tampering is blocked at a lower layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
