CVE-2026-17762: Chrome for iOS Information Disclosure Flaw

CVE-2026-17762 Overview

CVE-2026-17762 is an inappropriate implementation vulnerability in Chrome for iOS affecting Google Chrome on iOS versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. Google classifies the Chromium security severity as Medium. The flaw undermines the same-origin policy, which browsers rely on to isolate content between different web origins. Successful exploitation allows an attacker-controlled page to read data belonging to another origin loaded in the browser.

Critical Impact
Remote attackers can leak cross-origin data from Chrome for iOS users by convincing them to visit a crafted HTML page, breaking browser origin isolation guarantees.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Any web session where the user visits attacker-controlled content in an unpatched Chrome for iOS build

Discovery Timeline

2026-07-30 - CVE-2026-17762 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17762

Vulnerability Analysis

The vulnerability is categorized as an inappropriate implementation flaw in Chrome for iOS. Inappropriate implementation issues in Chromium typically indicate that a browser feature enforces its security policies incorrectly rather than a memory corruption defect. In this case, the implementation gap allows a remote attacker to bypass cross-origin restrictions and exfiltrate data belonging to another origin. The impact is scoped to information disclosure across origins, with no indication of code execution or sandbox escape. Google's public advisory tracks the issue at Medium severity in the Chromium risk model.

Root Cause

The root cause resides in Chrome for iOS implementation logic that fails to correctly enforce cross-origin boundaries when handling content in a crafted HTML page. Because iOS requires all browsers to use the WebKit rendering engine, Chrome-specific wrapper code around WebKit may introduce policy gaps not present in desktop Chromium. The precise component and code path are not disclosed in the public advisory referenced in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires a user to visit an attacker-controlled webpage in a vulnerable Chrome for iOS build. The attacker delivers a crafted HTML page that triggers the flawed implementation to read data belonging to another origin. The vector is remote and network-based, and no privileges are required on the target device. User interaction is required in the form of navigation to the malicious page. Detailed exploitation code is not available in public sources. See the Chrome Stable Channel Update for vendor context.

Detection Methods for CVE-2026-17762

Indicators of Compromise

Chrome for iOS clients reporting User-Agent strings for versions earlier than 151.0.7922.72
Outbound navigation from managed iOS devices to unfamiliar domains hosting HTML pages that reference multiple third-party origins
Unexpected cross-origin resource requests originating from mobile Chrome sessions in web proxy or DNS logs

Detection Strategies

Inventory Chrome for iOS versions across managed devices using MDM telemetry and flag builds below 151.0.7922.72.
Correlate proxy and DNS logs for iOS Chrome user agents visiting newly registered or low-reputation domains hosting rich HTML content.
Hunt for anomalous referer patterns where sensitive internal web applications are loaded shortly after a user visits an external page.

Monitoring Recommendations

Enable web gateway logging for mobile browser traffic, including full URL, referer, and origin headers.
Monitor MDM compliance dashboards for Chrome for iOS version drift and enforce automatic app updates.
Alert on cross-origin data access patterns to internal SaaS or webmail from mobile Chrome sessions immediately following third-party page visits.

How to Mitigate CVE-2026-17762

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later on all managed and personal devices.
Enforce automatic app updates through Apple Business Manager or MDM policy for the Chrome app.
Communicate the advisory to users and instruct them to avoid untrusted links until updates are applied.

Patch Information

Google addressed the vulnerability in Chrome for iOS 151.0.7922.72. Details are published in the Chrome Stable Channel Update, with tracking in the Chromium Issue Tracker Entry. Users should install the update through the Apple App Store as soon as it is available on their device.

Workarounds

Use an alternate updated browser on iOS until the Chrome update is installed on the device.
Restrict access to sensitive internal web applications from mobile Chrome sessions using conditional access policies.
Apply web content filtering to block navigation to unclassified or newly registered domains from managed iOS devices.

bash

# Verify Chrome for iOS version via MDM query (example: Jamf Pro)
# Query installed app version and flag devices below the fixed build
# Fixed version: 151.0.7922.72
curl -s -u "$JAMF_USER:$JAMF_PASS" \
  -H "Accept: application/json" \
  "$JAMF_URL/JSSResource/mobiledeviceapplications/bundleid/com.google.chrome.ios" \
  | jq '.mobile_device_application.general | {name, version, bundle_id}'