CVE-2026-17775: Google Chrome Information Disclosure Flaw

CVE-2026-17775 Overview

CVE-2026-17775 is an inappropriate implementation vulnerability in the PresentationAPI component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by serving a crafted HTML page to a victim. The Chromium project rates the security severity as Medium.

The flaw undermines the same-origin policy enforced by the browser. Web content controlled by an attacker can read data that belongs to a different origin, breaking a foundational browser security boundary.

Critical Impact
Remote attackers can exfiltrate cross-origin data from a victim's browser session through a malicious HTML page, bypassing same-origin protections in the PresentationAPI.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable PresentationAPI implementation
Downstream distributions that had not yet integrated the Chrome 151 stable channel fix

Discovery Timeline

2026-07-30 - CVE-2026-17775 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17775

Vulnerability Analysis

The vulnerability resides in Chrome's PresentationAPI, the web platform interface that allows a controlling page to launch and communicate with a presentation on a secondary display or receiving device. The implementation fails to properly enforce origin boundaries when handling certain presentation-related interactions.

An attacker who convinces a user to load a crafted HTML page can trigger the flawed logic. The result is an information disclosure across origins, meaning content from another site loaded by the same browser can be read by attacker-controlled JavaScript.

Cross-origin leaks in browsers are frequently used as building blocks for larger attack chains. Attackers pair them with authenticated session state on a target origin to extract data the browser would otherwise isolate.

Root Cause

Google's advisory characterizes the issue as an "inappropriate implementation" rather than a memory corruption bug. This category typically indicates that logic within the API does not correctly apply origin checks, referrer scrubbing, or state isolation between principals. Refer to the Chromium Issue Tracker Entry for further technical detail once access restrictions are lifted.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled or attacker-influenced web page. No authentication is needed on the target origin beyond the victim's existing browser state. User interaction is limited to normal browsing behavior.

The vulnerability manifests through the PresentationAPI request and message flow. See the Chrome Releases Desktop Update for the vendor's stable channel notes describing the fixed component.

Detection Methods for CVE-2026-17775

Indicators of Compromise

Browser telemetry showing outbound Chrome versions below 151.0.7922.72 accessing untrusted external sites
Web pages invoking PresentationRequest or navigator.presentation APIs from low-reputation origins
Unexpected cross-origin data appearing in outbound HTTP requests from browser processes

Detection Strategies

Inventory installed Chrome and Chromium-derivative versions across managed endpoints and flag builds older than 151.0.7922.72
Inspect proxy and DNS logs for user visits to newly registered or low-reputation domains hosting HTML that references presentation APIs
Correlate browser process network activity with sensitive internal application origins to identify unusual cross-origin flows

Monitoring Recommendations

Enable enterprise browser reporting or management policies to centralize version data and extension inventories
Alert on Chrome installations that fall behind the current stable channel for more than a defined patch window
Track user reports of unexpected casting or presentation prompts, which may indicate abuse attempts

How to Mitigate CVE-2026-17775

Immediate Actions Required

Update Google Chrome Desktop to version 151.0.7922.72 or later on all managed endpoints
Verify that Chromium-based browsers used in the environment have integrated the upstream fix before permitting continued use
Restart browser sessions after updates to ensure the patched binaries are loaded

Patch Information

Google addressed the issue in the Chrome stable channel release 151.0.7922.72. Deployment details are available in the Chrome Releases Desktop Update. The corresponding Chromium tracking record is the Chromium Issue Tracker Entry.

Workarounds

Enforce automatic Chrome updates through enterprise policy so users cannot defer patching
Restrict access to untrusted websites through web filtering while updates propagate
Where the PresentationAPI is not needed for business functions, evaluate policies that limit its exposure through managed browser configuration

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed Chrome version from the registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version