CVE-2026-17674: Google Chrome CSP Bypass Vulnerability

CVE-2026-17674 Overview

CVE-2026-17674 is a Content Security Policy (CSP) bypass vulnerability in Google Chrome versions prior to 151.0.7922.72. The flaw stems from an inappropriate implementation in Chrome's HTML handling logic. A remote attacker can exploit the issue by serving a crafted HTML page to a targeted user. Successful exploitation allows the attacker to circumvent CSP protections, weakening a key browser defense against cross-site scripting and data exfiltration. Chromium engineers rated the security severity as High. The issue affects the Chrome Stable channel across desktop platforms and was resolved in the July 2026 stable channel update.

Critical Impact
Attackers can bypass Content Security Policy through a crafted HTML page, neutralizing a primary defense-in-depth control against script injection and data theft in the browser.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating vulnerable upstream builds
Downstream distributions that repackage Chrome/Chromium below the fixed version

Discovery Timeline

2026-07-30 - CVE-2026-17674 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17674

Vulnerability Analysis

The vulnerability resides in Chrome's HTML processing pipeline. According to the Chromium advisory, an inappropriate implementation permits a remote attacker to bypass Content Security Policy through a crafted HTML page. CSP is enforced by the browser to constrain which scripts, styles, and resources a page may load. When a bypass is possible, an attacker-controlled or attacker-injected payload can execute outside the boundaries the site owner defined in the CSP header.

The practical effect is that CSP-based mitigations against reflected and stored cross-site scripting no longer provide their intended protection on a vulnerable client. Sites relying on strict CSP as a compensating control for legacy XSS sinks lose that layer until users update. The EPSS score is 0.305% at the 22.88 percentile, reflecting a low current probability of observed exploitation, but the impact class remains High per Chromium's own rating.

Root Cause

Google has not published low-level technical details while user rollout completes. The advisory identifies the class of defect as an inappropriate implementation in HTML, which typically maps to a specification enforcement gap rather than a memory-safety bug. See the Chromium Issue Tracker Entry for the tracking record and the Google Chrome Update Announcement for release notes.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome build. The attacker delivers the page through a malicious site, a compromised third-party resource, an ad network, or an HTML-capable phishing lure. Once loaded, the crafted markup exercises the flawed HTML path to bypass CSP directives on the page or on a target origin. No verified public proof-of-concept code is available at the time of publication. Technical mechanics should be described in prose only; see the vendor references for authoritative details.

Detection Methods for CVE-2026-17674

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in endpoint inventory data
Outbound requests from browser processes to domains not permitted by expected CSP allowlists on visited sites
Unexpected Content-Security-Policy violation reports arriving from user agents identifying as older Chrome builds

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome build below 151.0.7922.72
Ingest CSP violation reports from internal applications into the SIEM and correlate against outdated user-agent strings
Hunt for suspicious child processes or script downloads spawned from chrome.exe following navigation to untrusted domains

Monitoring Recommendations

Track browser telemetry through EDR to identify hosts running unpatched Chrome versions
Monitor proxy and DNS logs for connections to newly registered domains delivering HTML payloads to Chrome clients
Alert on discrepancies between the CSP header issued by internal apps and the resources actually loaded by client browsers

How to Mitigate CVE-2026-17674

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome processes after deployment to ensure the patched binary is active in memory
Verify Chromium-based derivative browsers used in the environment have absorbed the upstream fix

Patch Information

Google addressed CVE-2026-17674 in the Chrome Stable channel release 151.0.7922.72 for desktop. Administrators should push the update through enterprise management tooling such as Chrome Browser Cloud Management, Group Policy, or Jamf. Refer to the Google Chrome Update Announcement for platform-specific build numbers and rollout status.

Workarounds

Restrict access to untrusted web content through URL filtering or secure web gateways until patching completes
Enforce strict site isolation and disable unnecessary browser extensions that may amplify CSP-bypass impact
Apply defense-in-depth server-side controls such as output encoding and template auto-escaping so that CSP is not the sole barrier to script injection

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify on Linux
google-chrome --version