CVE-2026-17724: Google Chrome iOS UXSS Vulnerability

CVE-2026-17724 Overview

CVE-2026-17724 is a race condition vulnerability in Google Chrome for iOS versions prior to 151.0.7922.72. The flaw allows a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page, resulting in Universal Cross-Site Scripting (UXSS). Chromium security engineers rated the severity as High. The weakness is classified under CWE-362, concurrent execution using shared resources with improper synchronization.

Critical Impact
Successful exploitation enables UXSS, letting an attacker execute arbitrary scripts in the context of any origin loaded in the browser, breaking the same-origin policy.

Affected Products

Google Chrome for iOS prior to 151.0.7922.72
iOS deployments running vulnerable Chrome builds
Downstream Chromium-based iOS applications inheriting the affected release

Discovery Timeline

2026-07-30 - CVE-2026-17724 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17724

Vulnerability Analysis

The vulnerability is a race condition in Chrome for iOS that leads to Universal Cross-Site Scripting. UXSS differs from traditional XSS because the flaw resides in the browser itself, not in a specific web application. An attacker exploiting this class of bug can inject scripts that run in the security context of an arbitrary origin. A crafted HTML page delivered to a vulnerable browser triggers the race window and enables the injection. The impact extends across every site the victim visits during the session.

Root Cause

The root cause is improper synchronization between concurrent operations in Chrome for iOS, categorized under CWE-362. When two operations touch shared browser state without adequate locking or ordering guarantees, an attacker can interleave events to bypass origin isolation. The specific components involved are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires the victim to load a malicious HTML page in a vulnerable version of Chrome for iOS. No authentication is needed, and interaction is limited to visiting attacker-controlled content. The attacker races browser operations to inject HTML or JavaScript that executes across origin boundaries. Refer to the Google Chrome Update Announcement for vendor-provided context.

No verified public exploit code is available at the time of publication. The vulnerability mechanism is described in prose based on the vendor advisory rather than reconstructed synthetically.

Detection Methods for CVE-2026-17724

Indicators of Compromise

Chrome for iOS clients running builds earlier than 151.0.7922.72 connecting to unknown or newly registered domains hosting HTML payloads.
Browser telemetry showing script execution across mismatched origins or unexpected document.domain transitions.
Mobile device management (MDM) inventory records reporting outdated Chrome for iOS versions.

Detection Strategies

Inventory Chrome for iOS installations across managed devices and flag versions below 151.0.7922.72.
Inspect web proxy and DNS logs for iOS user agents visiting pages with heavy inline script combined with timing-sensitive DOM manipulation.
Correlate mobile browser crash reports with visits to untrusted URLs, since race exploitation attempts can produce renderer instability.

Monitoring Recommendations

Ingest mobile endpoint and browser version telemetry into your SIEM to alert on outdated Chrome for iOS clients.
Track outbound iOS browser sessions for anomalous cross-origin requests indicative of UXSS post-exploitation.
Monitor MDM compliance dashboards to confirm rapid uptake of the patched Chrome for iOS release.

How to Mitigate CVE-2026-17724

Immediate Actions Required

Update Chrome for iOS to version 151.0.7922.72 or later on every managed device.
Enforce mandatory browser updates through MDM policies for iOS fleets.
Communicate the advisory to end users and require restart of the browser after patching.

Patch Information

Google addressed the vulnerability in Chrome for iOS 151.0.7922.72. Details are available in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry. Apply the update through the Apple App Store or organizational MDM channels.

Workarounds

Restrict use of Chrome for iOS on managed devices until the update is applied, directing users to a patched alternative browser.
Block access to untrusted external HTML content through mobile web filtering policies.
Apply conditional access rules that require a minimum Chrome for iOS version before granting access to sensitive applications.

bash

# Configuration example: MDM query to identify vulnerable Chrome for iOS installs
# Replace with your MDM's actual query syntax
mdm-cli query devices \
  --app-bundle-id com.google.chrome.ios \
  --app-version-less-than 151.0.7922.72 \
  --output vulnerable-chrome-ios.csv