CVE-2026-17715: Google Chrome XSS Vulnerability

CVE-2026-17715 Overview

CVE-2026-17715 is an inappropriate implementation vulnerability in the Passwords component of Google Chrome prior to version 151.0.7922.72. A remote attacker who convinces a user to perform specific user interface gestures can leak cross-origin data through a crafted HTML page. Chromium rates the security severity as High.

The issue affects the browser's password subsystem and depends on user interaction with attacker-controlled content. Successful exploitation breaches the same-origin policy, exposing data from unrelated origins to the attacker's page.

Critical Impact
Attackers can extract cross-origin data from users who interact with a malicious page, undermining the same-origin policy that isolates web content.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers using the affected Passwords component
Desktop Chrome Stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17715 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17715

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords feature and is classified as an inappropriate implementation flaw. The Passwords component fails to enforce origin boundaries correctly during specific user interface interactions. When a user performs the required gestures on a crafted HTML page, the browser exposes data belonging to a different origin.

This category of Chrome issue commonly involves autofill, credential retrieval, or password manager UI elements that operate across frames or origins. The attacker's page relies on user gestures to trigger a code path that returns data the origin should not receive. The EPSS score is 0.288% at the 21.021 percentile, indicating low near-term exploitation probability.

Root Cause

The root cause is missing or incorrect origin checks in the Passwords implementation. The affected code path processes user-driven events without verifying that the target origin matches the origin permitted to receive the returned data. This falls under the User Interface Confusion and Information Exposure vulnerability classes.

Attack Vector

Exploitation requires a remote attacker to host a crafted HTML page and convince the victim to visit it. The victim must then perform specific UI gestures, such as clicks or form focus actions, that the attacker's page uses to trigger the flaw. Once triggered, cross-origin data flows into the attacker's context and can be exfiltrated to a controlled endpoint.

See the Chromium Issue Tracker Entry and the Google Chrome Update Blog for the vendor-published details.

Detection Methods for CVE-2026-17715

Indicators of Compromise

Chrome browser processes on version strings earlier than 151.0.7922.72 still running after the patch release.
Outbound HTTP or WebSocket traffic to unknown domains immediately after user interaction with an unfamiliar page.
Browser telemetry showing repeated password autofill prompts or dialogs on non-login pages.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below 151.0.7922.72.
Correlate web proxy logs with browsing history to identify visits to pages that solicit unusual click sequences before exfiltration traffic.
Monitor endpoint process telemetry for Chrome renderer processes making outbound connections to newly registered or low-reputation domains.

Monitoring Recommendations

Ingest Chrome version data into your SIEM and alert on out-of-date installs following each Chrome Stable release.
Track user reports of unexpected password prompts or autofill dialogs and investigate the originating pages.
Baseline DNS and HTTP traffic patterns from browsers to detect anomalous cross-origin data flows.

How to Mitigate CVE-2026-17715

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Force-restart Chrome sessions after the update to ensure the patched binary is active.
Audit Chromium-based browsers, such as Edge and Brave, and apply their corresponding upstream fixes when available.

Patch Information

Google released the fix in the Chrome Stable channel update documented on the Google Chrome Update Blog. Installing Chrome 151.0.7922.72 or later remediates the vulnerability. Enterprises using managed update policies should verify that automatic update mechanisms are enabled and unblocked.

Workarounds

Disable Chrome's built-in password manager through enterprise policy until endpoints receive the patch.
Restrict browsing to trusted sites via web filtering while remediation is in progress.
Advise users to avoid interacting with unexpected UI prompts on untrusted pages.

bash

# Verify Chrome version on Linux and macOS endpoints
google-chrome --version

# Windows PowerShell: check installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Enforce minimum version via Chrome Enterprise policy (JSON snippet)
{
  "BrowserSwitcherEnabled": false,
  "PasswordManagerEnabled": false
}