CVE-2026-17728: Google Chrome Extensions UXSS Vulnerability

CVE-2026-17728 Overview

CVE-2026-17728 affects the Extensions component in Google Chrome prior to version 151.0.7922.72. The flaw results from an inappropriate implementation that allows a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. This condition is classified as Universal Cross-Site Scripting (UXSS), enabling code execution within the security context of arbitrary origins loaded by the browser. Chromium engineers rated the underlying security severity as Medium.

Critical Impact
A remote attacker can bypass the same-origin policy via a crafted web page, executing scripts or HTML across origins through the Extensions subsystem.

Affected Products

Google Chrome (Desktop) prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable Extensions code prior to milestone 151
Downstream Chromium distributions that had not yet integrated the milestone 151 stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-17728 published to NVD
2026-07-30 - Last updated in NVD database
Additional details available in the Google Chrome Update Announcement and the Chromium Issue Tracker Entry

Technical Details for CVE-2026-17728

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions implementation. An inappropriate implementation permits a crafted HTML page to influence how extension code interacts with web content. The result is Universal Cross-Site Scripting, meaning injected scripts execute in the origin context of pages the user visits rather than being confined to the attacker's origin. UXSS defeats the browser's same-origin policy, which is a foundational web security boundary.

Root Cause

The root cause is an implementation defect in how Chrome's Extensions subsystem handles content delivered through a crafted HTML page. The advisory does not disclose the specific extension API or code path involved. Insufficient isolation between the attacker-controlled document and privileged extension-mediated content allows script and HTML content to reach unintended origins.

Attack Vector

Exploitation requires the victim to load an attacker-controlled or attacker-influenced HTML page in an affected Chrome build. No authentication is required, and the attack occurs over the network. Once triggered, the attacker gains the ability to inject arbitrary scripts or HTML that execute with the privileges of the targeted origin, enabling session theft, credential harvesting, and further phishing or supply-chain-style pivots into browser extensions.

No public proof-of-concept exploit is referenced in the advisory. The vulnerability mechanism is described in prose only; see the Chromium Issue Tracker Entry for technical detail as it becomes available after the restricted-disclosure period.

Detection Methods for CVE-2026-17728

Indicators of Compromise

Chrome desktop clients reporting a version earlier than 151.0.7922.72 in browser telemetry or user-agent logs.
Unexpected script execution or DOM modifications on trusted origins visited immediately after loading an untrusted third-party page.
Anomalous outbound requests from browser sessions carrying session tokens or cookies scoped to unrelated origins.

Detection Strategies

Inventory managed endpoints for Chrome versions below 151.0.7922.72 using endpoint management and asset discovery tooling.
Correlate web proxy logs to identify users loading suspicious HTML pages followed by cross-origin script activity within the same browser session.
Review installed extensions for unexpected changes to permissions, background pages, or content scripts.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to identify outdated Chrome installations at scale.
Alert on new or modified extension installations, especially those requesting broad host permissions such as <all_urls>.
Monitor authentication systems for session anomalies that could indicate token theft resulting from UXSS.

How to Mitigate CVE-2026-17728

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Force-restart Chrome after deployment so the updated binary and Extensions code are actually loaded.
Audit installed extensions and remove any that are unnecessary, unmaintained, or sourced outside enterprise policy.

Patch Information

Google fixed the issue in the stable channel update to Chrome 151.0.7922.72. Refer to the Google Chrome Update Announcement for release notes. Chromium-based browsers should upgrade to a build incorporating the milestone 151 fix.

Workarounds

Enforce Chrome auto-update via enterprise policy so patched builds roll out without user action.
Restrict extension installation to an allowlist using the ExtensionInstallAllowlist and ExtensionInstallBlocklist policies until patch coverage is verified.
Advise users to avoid loading untrusted HTML pages, particularly those delivered through unsolicited links, until the update is confirmed.

bash

# Example Chrome enterprise policy (Linux managed policy JSON)
# Restrict extensions and enforce update channel until CVE-2026-17728 patch coverage is verified
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "TargetChannel": "stable",
  "ChromeVariations": 0
}