CVE-2026-17789: Chrome for iOS Auth Bypass Vulnerability

CVE-2026-17789 Overview

CVE-2026-17789 is an input validation vulnerability in Google Chrome for iOS. Chrome for iOS versions prior to 151.0.7922.72 fail to sufficiently validate untrusted input, allowing a remote attacker to bypass navigation restrictions through malicious network traffic. Chromium rates the security severity as Medium.

The weakness maps to [CWE-20] Improper Input Validation. Successful exploitation lets an attacker circumvent navigation controls enforced by the browser, which can be leveraged to redirect users or reach resources that should be blocked by policy.

Critical Impact
Remote attackers can bypass Chrome for iOS navigation restrictions using crafted network traffic, undermining browser-enforced access controls.

Affected Products

Google Chrome for iOS prior to 151.0.7922.72

Discovery Timeline

2026-07-30 - CVE CVE-2026-17789 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17789

Vulnerability Analysis

The vulnerability resides in Chrome for iOS navigation handling. Chrome does not sufficiently validate untrusted input received over the network before applying it to navigation decisions. An attacker who influences the traffic reaching the browser can inject values that cause Chrome to bypass restrictions that would normally block a navigation.

Because the flaw involves navigation restriction enforcement rather than memory safety, exploitation focuses on reaching disallowed origins or resources. This can be paired with phishing pages, hosted content, or downstream vulnerabilities to expand impact.

Root Cause

The root cause is improper input validation [CWE-20] in the Chrome for iOS code path that processes network-supplied data used to make navigation policy decisions. Trust boundaries between attacker-controlled network content and internal navigation state are not enforced strictly enough. The specific Chromium issue tracker entry 513855922 documents the internal fix, which enforces stricter validation on the affected inputs.

Attack Vector

Exploitation requires the victim to interact with attacker-influenced network traffic through Chrome for iOS. A network-positioned attacker or a malicious server delivers crafted content that produces navigation outcomes the browser would otherwise block. No local access is required, and the flaw is triggered remotely through normal browser use.

No verified public proof-of-concept is available. See the Chrome Blog Update and the Chromium Issue Tracker Entry for vendor detail.

Detection Methods for CVE-2026-17789

Indicators of Compromise

Chrome for iOS clients running builds earlier than 151.0.7922.72 observed in mobile device management or web analytics telemetry.
Unexpected navigations from Chrome iOS user agents to origins that should be blocked by proxy or content policy.
HTTP responses containing malformed or unusual redirect and navigation headers reaching iOS Chrome clients.

Detection Strategies

Inventory Chrome for iOS versions across managed devices and flag any build below 151.0.7922.72.
Correlate proxy and DNS logs with mobile browsing telemetry to identify navigations that bypass policy categories.
Alert on repeated redirect chains or protocol handler transitions initiated from Chrome iOS sessions.

Monitoring Recommendations

Ingest mobile browser and network egress logs into a centralized analytics platform for cross-source correlation.
Monitor MDM compliance reports for Chrome for iOS version drift and enforce minimum version policies.
Track outbound traffic to newly registered or low-reputation domains reached from iOS Chrome sessions.

How to Mitigate CVE-2026-17789

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later on all managed and personal devices.
Enforce the minimum Chrome for iOS version through mobile device management compliance policies.
Communicate the update requirement to users who install Chrome outside of MDM control.

Patch Information

Google addressed the issue in Chrome for iOS 151.0.7922.72. Refer to the Chrome Blog Update for release details and the Chromium Issue Tracker Entry for the underlying fix reference.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is confirmed installed.
Route mobile browser traffic through a filtering proxy that enforces navigation policy independent of the browser.
Educate users to avoid untrusted networks and links while an unpatched Chrome for iOS build is in use.

bash

# Configuration example: MDM compliance rule enforcing minimum Chrome for iOS version
minimum_app_version:
  bundle_id: com.google.chrome.ios
  version: "151.0.7922.72"
  action: block_launch_if_below