CVE-2026-17720 Overview
CVE-2026-17720 is an insufficient policy enforcement vulnerability in the Passwords component of Google Chrome versions prior to 151.0.7922.72. A remote attacker who has already compromised the renderer process can leak cross-origin data by delivering a crafted HTML page. Chromium engineers rated the security severity as High. The flaw undermines the same-origin policy protections that isolate password data between web origins.
Critical Impact
An attacker with a compromised renderer can exfiltrate cross-origin data, including data handled by the Passwords component, through a specially crafted HTML page.
Affected Products
- Google Chrome for Desktop versions prior to 151.0.7922.72
- Chromium-based browsers incorporating the vulnerable Passwords component
- Downstream distributions synced from the pre-patched Chromium tree
Discovery Timeline
- 2026-07-30 - CVE-2026-17720 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17720
Vulnerability Analysis
The vulnerability sits in the Passwords subsystem, which manages saved credentials and autofill flows in Chrome. Policy enforcement in this component fails to fully constrain cross-origin data access when a renderer process has been compromised. An attacker who already controls the renderer, typically via a chained bug such as a memory corruption or type confusion issue, can use a crafted HTML page to reach data that should remain isolated by the same-origin policy.
The issue is classified as an information disclosure flaw resulting from broken access control at the browser policy layer. It does not directly grant code execution, but it enables data theft across origin boundaries.
Root Cause
The Passwords component does not sufficiently enforce origin-based policy checks on certain data paths. When a renderer is under attacker control, the missing enforcement allows requests or lookups that should be blocked by same-origin restrictions. The result is that data belonging to one origin can be observed by content associated with another.
Attack Vector
Exploitation requires an attacker to first compromise the renderer process, which usually means chaining CVE-2026-17720 with a separate renderer-level bug. Once the renderer is controlled, the attacker serves a crafted HTML page that triggers the flawed policy path in the Passwords component. The page then reads cross-origin data that would otherwise be inaccessible. No user interaction is required beyond visiting attacker-influenced content.
No public proof-of-concept is available in the referenced sources. Technical specifics are tracked in the Chromium Issue Tracker Entry and the Google Chrome Update Announcement.
Detection Methods for CVE-2026-17720
Indicators of Compromise
- Chrome browser processes running versions earlier than 151.0.7922.72 after the patch release window
- Renderer processes exhibiting anomalous crashes or sandbox escape indicators prior to suspicious outbound traffic
- Unexpected outbound HTTP or HTTPS requests carrying credential-shaped payloads from browser processes
Detection Strategies
- Inventory installed Chrome and Chromium-derived browser versions across managed endpoints and flag anything below 151.0.7922.72.
- Correlate browser crash telemetry with subsequent network egress to detect potential renderer compromise chains.
- Monitor for loads of untrusted HTML from ad networks, embedded iframes, or newly registered domains preceding credential-related anomalies.
Monitoring Recommendations
- Ingest browser version and update status into the SIEM to track patch compliance over time.
- Alert on browser child processes making network connections to non-corporate destinations shortly after visiting unknown sites.
- Review password manager and autofill events for cross-origin usage patterns that deviate from user baselines.
How to Mitigate CVE-2026-17720
Immediate Actions Required
- Update Google Chrome to 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
- Force-restart browser sessions after deployment to ensure the patched binary is loaded into memory.
- Push the update to Chromium-based browsers once their vendors ship the corresponding fix.
Patch Information
Google addressed the issue in the Stable channel release 151.0.7922.72. Deployment details are documented in the Google Chrome Update Announcement. Enterprise administrators should validate that managed update policies allow the new build to install without user intervention.
Workarounds
- Enforce automatic browser updates through group policy or MDM to eliminate lag between patch release and deployment.
- Restrict use of the built-in password manager on high-risk endpoints until patch coverage is verified.
- Apply strict content filtering and DNS controls to reduce exposure to attacker-controlled HTML while patching is in progress.
# Verify installed Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Expected output should be 151.0.7922.72 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
