CVE-2026-17764: Google Chrome FedCM Auth Bypass Flaw

CVE-2026-17764 Overview

CVE-2026-17764 affects the Federated Credential Management (FedCM) implementation in Google Chrome versions prior to 151.0.7922.72. The flaw allows a remote attacker to bypass the same origin policy by serving a crafted HTML page to a targeted user. Google's Chromium project rates the security severity as Medium. Exploitation requires the victim to load attacker-controlled web content in a vulnerable Chrome build. Successful exploitation can undermine cross-origin isolation guarantees that browsers depend on to keep site data separated.

Critical Impact
A remote attacker can bypass the same origin policy through crafted HTML, weakening a foundational browser security boundary that protects credentials and cross-site data.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers that inherit the vulnerable FedCM implementation
Deployments that have not applied the Chrome Stable channel update referenced in the Google Chrome Stable Update

Discovery Timeline

2026-07-30 - CVE-2026-17764 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17764

Vulnerability Analysis

The vulnerability resides in Chrome's implementation of Federated Credential Management (FedCM), the browser API that mediates federated sign-in between identity providers and relying parties. An inappropriate implementation in FedCM lets a crafted page influence how the browser scopes requests or responses across origins. The result is a same origin policy bypass triggered from an attacker-controlled HTML document.

Because FedCM handles authentication material and identity metadata, a same origin policy weakness in this subsystem can expose data intended to remain isolated to a single origin. The advisory does not indicate memory corruption or remote code execution, and Chromium engineers classify the issue as a logic bypass rather than a memory safety flaw.

Root Cause

Google's advisory describes the defect as an inappropriate implementation within FedCM. The behavior deviates from the browser's origin isolation model, but Chromium has not disclosed further technical detail while patch adoption stabilizes. Restricted details appear in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation is network-based and user-interactive. An attacker hosts a crafted HTML page and lures a victim running a vulnerable Chrome build to visit it. When the page invokes FedCM in the abusive pattern, the browser fails to enforce the expected origin boundary. No authentication or elevated privileges are required on the target endpoint.

The vulnerability manifests in Chrome's FedCM request handling code path. See the Google Chrome Stable Update advisory and the linked Chromium tracker entry for technical details as they become public.

Detection Methods for CVE-2026-17764

Indicators of Compromise

Chrome browsers reporting a version string earlier than 151.0.7922.72 in user-agent telemetry or endpoint inventory
Outbound navigations to untrusted domains immediately followed by unexpected federated sign-in prompts
Web content invoking the FedCM API from origins that are not established identity providers in the environment

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag hosts below 151.0.7922.72 for prioritized patching
Correlate proxy and DNS logs for user visits to newly registered or low-reputation domains that subsequently trigger identity API activity
Review browser enterprise reporting for FedCM usage patterns that do not align with sanctioned identity providers

Monitoring Recommendations

Ingest Chrome version telemetry and web proxy logs into a central analytics platform to track patch compliance and suspicious FedCM interactions
Alert on repeated cross-origin credential prompts originating from a single external domain across multiple users
Track Google's Chrome release channel notes for follow-up fixes or regressions tied to FedCM

How to Mitigate CVE-2026-17764

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
Force a browser restart after the update so the patched FedCM code path is loaded
Verify version compliance across managed endpoints using enterprise browser management or endpoint inventory tooling

Patch Information

Google addressed CVE-2026-17764 in the Chrome Stable channel update announced in the Google Chrome Stable Update. Administrators should ensure Chrome auto-update is enabled and confirm that endpoints have received 151.0.7922.72 or a later build. Chromium-derived browsers should adopt the upstream fix from the corresponding Chromium release.

Workarounds

Restrict FedCM usage through Chrome enterprise policies where the API is not required for business workflows
Block or reputation-filter untrusted domains at the web proxy to reduce exposure to crafted HTML delivery
Advise users to avoid unsolicited sign-in prompts and to report unexpected identity provider dialogs

bash

# Verify installed Chrome version on managed endpoints
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 151.0.7922.72 or later