CVE-2026-17761: Chrome for iOS UXSS Vulnerability

CVE-2026-17761 Overview

CVE-2026-17761 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome for iOS. The flaw stems from insufficient validation of untrusted input in the iOS build of Chrome. A remote attacker can inject arbitrary scripts or HTML via malicious network traffic. Google rates the Chromium security severity as Medium.

The vulnerability affects all Chrome for iOS versions prior to 151.0.7922.72. Successful exploitation lets an attacker execute script in the context of arbitrary origins, bypassing the same-origin policy. This mapping to [CWE-20] reflects the improper input validation root cause.

Critical Impact
Attackers can execute scripts across origin boundaries in Chrome for iOS, enabling session theft, credential harvesting, and content manipulation on trusted sites.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72

Discovery Timeline

2026-07-30 - CVE CVE-2026-17761 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17761

Vulnerability Analysis

The vulnerability is a Universal Cross-Site Scripting (UXSS) flaw. UXSS differs from traditional XSS because the flaw resides in the browser itself, not in a targeted web application. An attacker exploiting UXSS can inject script into any origin the victim loads, breaking the same-origin policy that isolates websites from one another.

Google's advisory attributes the flaw to insufficient validation of untrusted input handled by Chrome for iOS. Malicious network traffic serves as the delivery mechanism, meaning an attacker positioned to influence responses can trigger the injection. The Chromium project tracks the underlying defect under [CWE-20: Improper Input Validation].

Root Cause

Chrome for iOS fails to properly validate untrusted input before rendering or handling it. The unvalidated data crosses trust boundaries and is interpreted as executable script or HTML. Because iOS Chrome relies on Apple's WebKit engine, the flaw resides in Chrome-specific glue code that processes network content on top of WebKit.

Attack Vector

The attack vector is remote and network-based. An attacker delivers crafted content through malicious network traffic, such as a hostile web page, a compromised third-party resource, or a man-in-the-middle position on an unencrypted or misconfigured connection. When Chrome for iOS parses this content, the injected script or HTML executes in the context of an origin the attacker should not control.

Exploitation does not require credentials or elevated privileges on the device. Refer to the Google Chrome Update Announcement and the Chromium Issue Tracker Entry for vendor detail.

Detection Methods for CVE-2026-17761

Indicators of Compromise

Chrome for iOS clients running versions below 151.0.7922.72 in mobile device management inventory.
Anomalous outbound requests from mobile browsers to attacker-controlled domains following visits to third-party sites.
Unexpected script execution or DOM modifications observed in web application logs from iOS Chrome user agents.

Detection Strategies

Inventory installed Chrome for iOS versions across managed devices and flag any build older than 151.0.7922.72.
Correlate mobile browser telemetry with web application firewall logs to identify script injection attempts targeting iOS Chrome sessions.
Monitor for TLS downgrade or interception activity on networks used by mobile users, since malicious network traffic is the delivery vector.

Monitoring Recommendations

Enable mobile threat defense telemetry on iOS devices to track browser version drift.
Log and review web server access patterns from iOS Chrome user agents for cross-origin anomalies.
Alert on repeated authentication failures or session anomalies originating from iOS Chrome, which may indicate stolen session material.

How to Mitigate CVE-2026-17761

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store.
Push the update through mobile device management to enforce minimum browser version policies.
Notify users to restart Chrome after updating to complete the patch installation.

Patch Information

Google addressed the flaw in Chrome for iOS 151.0.7922.72. Details of the stable channel release are published in the Google Chrome Update Announcement. Tracking metadata is available in the Chromium Issue Tracker Entry.

Workarounds

Use an alternate up-to-date browser on iOS until Chrome is updated on affected devices.
Restrict use of untrusted networks and require VPN connectivity for corporate mobile browsing to reduce exposure to malicious network traffic.
Enforce HTTPS-only mode where supported to reduce the ability of a network attacker to inject content into browser sessions.

bash

# Configuration example: query enrolled iOS devices for outdated Chrome via MDM
# Replace with your MDM's actual query syntax
mdm-cli query --app-bundle-id com.google.chrome.ios \
  --field version --filter "version < 151.0.7922.72"