CVE-2026-17780: Google Chrome Auth Bypass Vulnerability

CVE-2026-17780 Overview

CVE-2026-17780 is a security flaw in Google Chrome's Isolated Web Apps (IWA) implementation. Versions of Chrome prior to 151.0.7922.72 contain an inappropriate implementation that permits a remote attacker to bypass navigation restrictions using a crafted HTML page. Chromium rates the security severity as Medium.

The flaw undermines a boundary control that Isolated Web Apps rely on to constrain where an app can navigate. An attacker hosting a malicious page can leverage the weakness against users browsing with a vulnerable Chrome build.

Critical Impact
Remote attackers can bypass navigation restrictions in Isolated Web Apps by serving a crafted HTML page to a vulnerable Chrome client.

Affected Products

Google Chrome Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Isolated Web Apps code
Applications embedding affected Chromium builds with IWA support enabled

Discovery Timeline

2026-07-30 - CVE-2026-17780 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17780

Vulnerability Analysis

The vulnerability resides in Chrome's Isolated Web Apps subsystem. Isolated Web Apps are packaged web applications that run with stronger isolation guarantees than standard web content. Part of that guarantee is enforcement of navigation restrictions that prevent an IWA from being coerced into loading arbitrary origins.

The implementation prior to Chrome 151.0.7922.72 handled navigation decisions incorrectly under specific conditions. An attacker-controlled HTML page can trigger the flawed logic and cause the browser to permit navigations that should be blocked. This weakens the origin and content boundaries that IWAs depend on for their security model.

The issue is classified as an inappropriate implementation rather than a memory-corruption bug. Exploitation does not require prior authentication and can be attempted by any remote site the victim visits.

Root Cause

The root cause is faulty policy enforcement inside the Isolated Web Apps component. Navigation restriction checks fail to cover the full set of navigation paths available to a crafted page. Google's fix in 151.0.7922.72 tightens the enforcement logic. Public technical details are limited; see the Chromium Issue Tracker Entry once access restrictions are lifted.

Attack Vector

Exploitation requires a user running a vulnerable Chrome build to load a crafted HTML page controlled by the attacker. The page uses the flawed navigation path to bypass IWA restrictions. No user interaction beyond visiting the page is required. Refer to the Google Chrome Update Announcement for the vendor's release notes.

No public proof-of-concept code has been released. A prose description of the mechanism is used here in place of synthetic exploit code.

Detection Methods for CVE-2026-17780

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in endpoint inventory data
Isolated Web App sessions initiating unexpected cross-origin navigations to attacker-controlled domains
Web proxy logs showing users visiting untrusted pages immediately before anomalous IWA network activity

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 151.0.7922.72
Monitor browser telemetry for navigation events originating from Isolated Web App contexts to unexpected external origins
Correlate outbound HTTP requests from browser processes with newly loaded HTML pages from low-reputation domains

Monitoring Recommendations

Enable centralized Chrome update reporting through Chrome Browser Cloud Management or equivalent policy tooling
Ingest browser process telemetry and DNS logs into a SIEM for correlation of pre- and post-navigation activity
Alert on Chrome installations that fall behind the current stable channel version for more than seven days

How to Mitigate CVE-2026-17780

Immediate Actions Required

Update Google Chrome Desktop to version 151.0.7922.72 or later on all managed endpoints
Restart Chrome after the update completes to ensure the patched binary is active
Audit Chromium-based browsers and embedded frameworks for the same underlying code and update accordingly

Patch Information

Google released Chrome 151.0.7922.72 on the stable channel with the fix for CVE-2026-17780. Details are published in the Google Chrome Update Announcement. Enterprises using Chrome Browser Cloud Management should push the updated version through managed policy.

Workarounds

Disable or restrict use of Isolated Web Apps through enterprise policy until the update is deployed
Enforce a browser allowlist that blocks navigation to untrusted external domains from managed devices
Increase web filtering aggressiveness to block low-reputation and newly registered domains that could host crafted pages

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Required minimum version: 151.0.7922.72