CVE-2026-17760 Overview
CVE-2026-17760 is a side-channel information leakage vulnerability in the NoStatePrefetch component of Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit the flaw by serving a crafted HTML page to a victim browser. Successful exploitation allows leakage of cross-origin data, breaking the same-origin policy that isolates content between web origins. Google classifies the Chromium security severity as Medium. The weakness maps to CWE-1300, covering improper protection of physical side channels.
Critical Impact
A crafted HTML page can leak cross-origin data from Chrome users through NoStatePrefetch side-channel behavior, undermining web origin isolation.
Affected Products
- Google Chrome Desktop versions prior to 151.0.7922.72
- Chromium-based browsers using the affected NoStatePrefetch implementation
- All operating system builds of Chrome Stable channel prior to the fixed release
Discovery Timeline
- 2026-07-30 - CVE-2026-17760 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17760
Vulnerability Analysis
The vulnerability resides in NoStatePrefetch, a Chrome mechanism that preloads resources for pages the user is likely to visit without executing scripts or committing state. NoStatePrefetch is designed to fetch subresources so that a navigation initiated later feels faster. The flaw introduces an observable side channel during this prefetch process. An attacker can measure the timing or behavior of prefetch operations to infer information about resources loaded from other origins. Because prefetching interacts with cross-origin content, an inference channel violates the browser's origin isolation guarantees. The issue is classified under CWE-1300, improper protection of physical side channels.
Root Cause
NoStatePrefetch performs work that is externally observable to attacker-controlled JavaScript on the same page. Distinguishable timing, cache, or resource-fetch signals differ based on cross-origin state, letting an attacker infer data that should remain isolated. See the Chromium Issue Tracker Entry for implementation-specific details.
Attack Vector
Exploitation requires a victim to visit an attacker-controlled or attacker-influenced web page. The crafted HTML triggers NoStatePrefetch activity against target URLs and then measures the resulting side-channel signal. No user interaction beyond navigation is needed, and no authentication is required on the attacker's page.
No public proof-of-concept or exploit code is available. Refer to the Google Chrome Desktop Update advisory for vendor context.
Detection Methods for CVE-2026-17760
Indicators of Compromise
- No file-based indicators are published. Exploitation is browser-resident and does not produce persistent artifacts on disk.
- Outbound requests from user browsers to unfamiliar domains hosting prefetch-heavy HTML may indicate targeting.
Detection Strategies
- Inventory Chrome installations and flag any endpoint running a version earlier than 151.0.7922.72.
- Correlate browsing telemetry with threat intelligence to identify visits to pages that abuse prefetch behavior.
- Monitor for unusual patterns of cross-origin resource fetches originating from a single tab.
Monitoring Recommendations
- Ingest browser version telemetry into a centralized data lake for continuous exposure assessment.
- Track proxy and DNS logs for domains serving suspicious HTML with heavy <link rel="prerender"> or prefetch usage.
- Alert on Chrome processes making anomalous cross-origin requests shortly after navigation events.
How to Mitigate CVE-2026-17760
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
- Verify auto-update is enabled and functioning for Chrome deployments across Windows, macOS, and Linux.
- Push updated Chromium-based browser builds that incorporate the upstream fix once available from each vendor.
Patch Information
Google released the fix in Chrome Stable channel version 151.0.7922.72. Full release details are available in the Google Chrome Desktop Update announcement and the Chromium Issue Tracker Entry.
Workarounds
- Restart Chrome after updates install so the patched binary is loaded into memory.
- Where policy permits, disable network prediction and prefetch features through enterprise policy until patching completes.
- Restrict browsing to trusted sites via web filtering while remediation is in progress.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
