CVE-2026-17754: Google Chrome Blink Auth Bypass Flaw

CVE-2026-17754 Overview

CVE-2026-17754 is a same-origin policy bypass in the Blink rendering engine of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can bypass same-origin policy protections by serving a crafted HTML page to a target browser. Google classified the Chromium security severity as Medium.

The flaw stems from an inappropriate implementation in Blink, the component responsible for rendering web content in Chromium-based browsers. Successful exploitation allows an attacker-controlled origin to interact with resources belonging to other origins, undermining a foundational browser security boundary.

Critical Impact
A crafted web page can bypass the same-origin policy, enabling cross-origin data access and interaction that Chrome is designed to prevent.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding the vulnerable Blink engine
Downstream distributions that have not integrated the Chrome 151 stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-17754 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17754

Vulnerability Analysis

The vulnerability resides in Blink, the rendering engine used by Chrome and other Chromium-based browsers. Blink enforces the same-origin policy (SOP), which prevents a document or script loaded from one origin from reading or manipulating content served from a different origin. An inappropriate implementation in Blink allows this boundary to be bypassed when a browser loads a specially crafted HTML page.

While Google has not disclosed the exact code path, the outcome is a violation of the origin separation model. This class of issue typically enables attackers to read cross-origin responses, inspect protected DOM state, or invoke functionality that should be restricted to a document's own origin.

Root Cause

The root cause is an implementation error in Blink's handling of a web platform feature governed by same-origin checks. The relevant code path does not correctly apply origin restrictions, allowing an attacker-supplied HTML document to reach cross-origin resources. Google addressed the issue in Chrome stable release 151.0.7922.72. Additional detail is tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires only that a victim load an attacker-controlled HTML page in a vulnerable Chrome build. No authentication is required, and no privileged position on the network is needed. An attacker can host the crafted page on a public site, deliver it through phishing, or embed it through a compromised third-party resource such as an ad network. Once the page loads, its scripts can interact with content from other origins in ways the same-origin policy should prevent.

No verified proof-of-concept code has been published. See the Google Chrome Update Release for the vendor advisory.

Detection Methods for CVE-2026-17754

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in enterprise inventory data
Outbound requests from user endpoints to newly registered or low-reputation domains delivering HTML content followed by cross-origin API calls
Browser telemetry showing unexpected cross-origin fetch or XMLHttpRequest activity from attacker-controlled pages

Detection Strategies

Query endpoint inventory for installed Chrome versions and flag any build earlier than 151.0.7922.72 for remediation
Correlate web proxy logs with EDR process telemetry to identify Chrome instances visiting suspicious HTML resources prior to anomalous authenticated web session behavior
Monitor for signs of session data exfiltration or unauthorized API activity from user identities immediately after browsing sessions

Monitoring Recommendations

Track Chrome version distribution centrally and alert on endpoints that lag the current stable channel
Ingest web proxy, DNS, and endpoint browser telemetry into a central data lake for cross-source correlation
Review authentication logs for anomalous session reuse originating from user endpoints that visited untrusted sites

How to Mitigate CVE-2026-17754

Immediate Actions Required

Update Google Chrome on all managed endpoints to version 151.0.7922.72 or later
Force a browser restart after the update to ensure the patched Blink build is loaded
Audit Chromium-based browsers such as Edge, Brave, and Opera and apply their vendor updates that incorporate the same Blink fix

Patch Information

Google released the fix in the Chrome stable channel at version 151.0.7922.72. Details are published in the Google Chrome Update Release. Enterprises using managed browser deployment should push the update through Chrome Browser Cloud Management, Group Policy, MDM, or their standard software distribution tooling.

Workarounds

No vendor-supplied workaround exists; applying the Chrome 151 update is the required remediation
Restrict browsing to trusted sites through enterprise web filtering until all endpoints are patched
Enforce Chrome auto-update policies so future stable channel releases install without user intervention

bash

# Windows: verify Chrome version on an endpoint
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS: verify Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux: verify Chrome version
google-chrome --version

# Expected output: 151.0.7922.72 or later