CVE-2026-17693: Google Chrome Information Disclosure Flaw

CVE-2026-17693 Overview

CVE-2026-17693 is an insufficient policy enforcement vulnerability in the FileSystem component of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data through a crafted HTML page. The Chromium project rates the security severity as High, while the NVD CVSS 3.1 base score is 4.3 (Medium).

The flaw maps to [CWE-346: Origin Validation Error], meaning the browser fails to correctly enforce origin boundaries within FileSystem operations. Exploitation requires user interaction, typically visiting an attacker-controlled page. The EPSS probability is 0.288% with a percentile of 21.021, indicating low near-term exploitation likelihood.

Critical Impact
A remote attacker can bypass Chrome's same-origin policy in the FileSystem API to read cross-origin data via a malicious webpage.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers sharing the vulnerable FileSystem implementation
All operating system builds of Chrome Stable channel below the patched release

Discovery Timeline

2026-07-30 - CVE-2026-17693 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17693

Vulnerability Analysis

The vulnerability resides in Chrome's FileSystem component, which exposes sandboxed storage APIs to web content. The component fails to enforce origin policy consistently across FileSystem operations. As a result, a page controlled by an attacker can access data associated with a different origin.

This is an information disclosure issue, not a memory corruption or code execution flaw. The confidentiality impact is limited to data reachable through the FileSystem interface. Integrity and availability are unaffected, according to the NVD vector.

Exploitation is remote and network-borne but requires the victim to load a crafted HTML page. That user interaction requirement limits the attack to drive-by or phishing-style delivery. See the Chromium Issue Tracker Entry for upstream tracking.

Root Cause

The root cause is an origin validation error [CWE-346] inside Chrome's FileSystem policy enforcement path. Checks that should isolate one web origin's storage from another are either missing or incomplete. This allows cross-origin references to succeed where the same-origin policy should have blocked them.

Attack Vector

The attack vector is network-based with low complexity and no required privileges. An attacker hosts a crafted HTML page and lures a user with a vulnerable Chrome build to visit it. Embedded JavaScript then abuses the FileSystem API to reference resources tied to another origin.

No authentication is required and no elevated permissions are needed on the target host. The scope is unchanged, and the leaked data is bounded by what the FileSystem component exposes. Refer to the Google Chrome Update Announcement for vendor context.

Detection Methods for CVE-2026-17693

Indicators of Compromise

Chrome desktop clients reporting a version string below 151.0.7922.72 in browser telemetry or user-agent logs
Outbound requests to unfamiliar domains immediately followed by cross-origin storage access patterns
HTML pages referencing FileSystem API entry points from origins unrelated to the site being visited

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds below 151.0.7922.72
Inspect web proxy logs for HTML content invoking webkitRequestFileSystem or FileSystem API calls tied to newly registered or low-reputation domains
Correlate browser process activity with unexpected file access in the Chrome user data directory

Monitoring Recommendations

Enable browser version reporting through enterprise management tools such as Chrome Browser Cloud Management
Forward browser and endpoint telemetry to a centralized analytics platform for version and behavior correlation
Monitor DNS and TLS logs for high-frequency requests to newly observed domains delivering HTML payloads

How to Mitigate CVE-2026-17693

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binary is loaded
Audit Chromium-based browsers and embedded WebViews for equivalent patched builds from their vendors

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Details are published in the Google Chrome Update Announcement. Enterprise administrators should distribute the update through their standard browser management channel.

Workarounds

Restrict user browsing to trusted domains via web proxy or DNS filtering until patching completes
Deploy enterprise policies that disable or restrict the FileSystem API where business needs allow
Educate users to avoid clicking untrusted links, since exploitation requires loading a crafted HTML page

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query registry for installed Chrome version
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv