CVE-2026-17765: Google Chrome Information Disclosure Flaw

CVE-2026-17765 Overview

CVE-2026-17765 is an inappropriate implementation vulnerability in the WebProtect component of Google Chrome prior to version 151.0.7922.72. A remote attacker who has already compromised the renderer process can leak cross-origin data via a crafted HTML page. Google classifies the Chromium security severity as Medium. The flaw undermines the Same-Origin Policy, which is a foundational browser security boundary that isolates content between origins.

Critical Impact
Attackers with renderer process control can bypass same-origin restrictions to read cross-origin data, exposing session tokens, authenticated responses, and sensitive user content from other web applications.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable WebProtect implementation
Downstream browsers that share the Chromium rendering pipeline until they merge the upstream fix

Discovery Timeline

2026-07-30 - CVE-2026-17765 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17765

Vulnerability Analysis

The vulnerability resides in WebProtect, a Chrome security component that enforces isolation guarantees between web origins. An inappropriate implementation in this component permits a compromised renderer to observe or exfiltrate data belonging to a different origin. Exploitation is a post-compromise primitive. The attacker must first control the renderer process, typically through a chained memory corruption or type confusion bug, then invoke the flawed WebProtect logic through a crafted HTML page.

The outcome is a cross-origin information disclosure. Data that should remain confined to its originating domain becomes reachable from attacker-controlled JavaScript or DOM constructs. This class of flaw is commonly used in exploit chains that combine a renderer RCE with a sandbox escape or data theft primitive.

Root Cause

The root cause is an incorrect enforcement path within WebProtect that fails to validate cross-origin boundaries under specific runtime conditions. The Chromium issue tracker entry 511765328 documents the internal report. Public technical detail beyond the vendor summary is not disclosed at this time.

Attack Vector

The attack requires two stages. First, the adversary compromises the renderer process, generally by exploiting a separate memory safety vulnerability delivered through a malicious or attacker-controlled web page. Second, the adversary serves crafted HTML that triggers the WebProtect misbehavior to read cross-origin resources. No user privilege elevation is required beyond visiting the attacker's page in a vulnerable Chrome build.

See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-published context.

Detection Methods for CVE-2026-17765

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints
Renderer processes making anomalous cross-origin fetches or exhibiting unexpected memory access patterns
Outbound network connections from browser processes to newly registered or low-reputation domains hosting exploit HTML

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72 as vulnerable
Correlate browser process telemetry with web proxy logs to identify visits to pages that trigger unusual renderer child process behavior
Monitor for renderer process crashes or restarts that may indicate exploitation attempts against the underlying renderer compromise primitive

Monitoring Recommendations

Enable enterprise browser reporting and forward Chrome events to a centralized SIEM for version and policy compliance tracking
Track referrer chains and script origins from EDR browser telemetry to detect cross-origin data exfiltration patterns
Alert on browser child processes spawning unexpected utility processes or making direct socket connections outside standard proxy paths

How to Mitigate CVE-2026-17765

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force a browser restart across the fleet to ensure the patched binary is loaded into memory
Verify Chromium-based third-party browsers have merged the upstream WebProtect fix before considering them remediated

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Refer to the Google Chrome Stable Update advisory for the full release notes and the Chromium Issue Tracker Entry for the tracked defect.

Workarounds

Enforce automatic Chrome updates through group policy or MDM to reduce exposure windows for future browser CVEs
Restrict access to untrusted web content using enterprise browsing policies, URL allowlists, or isolation technologies
Deploy site isolation and strict process-per-site configuration to reduce the impact of renderer compromise chains

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version