CVE-2026-17791 Overview
CVE-2026-17791 is an input validation vulnerability in the Payments component of Google Chrome versions prior to 151.0.7922.72. The flaw allows a remote attacker who has already compromised the renderer process to perform user interface (UI) spoofing through a crafted HTML page. Google classifies the Chromium security severity as Medium. The vulnerability is categorized under [CWE-20], improper input validation.
Critical Impact
An attacker with a compromised renderer process can present spoofed payment UI elements to deceive users into approving fraudulent transactions or disclosing sensitive payment data.
Affected Products
- Google Chrome versions prior to 151.0.7922.72
- Chromium-based browsers sharing the same Payments component
- Desktop Stable channel builds released before the July 2026 update
Discovery Timeline
- 2026-07-30 - CVE-2026-17791 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17791
Vulnerability Analysis
The vulnerability resides in the Payments subsystem of Google Chrome. Chrome fails to sufficiently validate untrusted input arriving from the renderer process before rendering payment-related UI. This gap enables an attacker who already controls the renderer to influence what the user sees during a payment flow. The result is a UI spoofing condition, where legitimate-looking browser chrome or payment dialogs can be manipulated to mislead the user.
UI spoofing bugs in payment surfaces are particularly consequential because users rely on browser-rendered indicators to confirm merchant identity, transaction totals, and payment method selection. A successful spoof erodes the trust boundary between site content and browser-managed payment UI.
Root Cause
The root cause is insufficient validation of untrusted input passed to the Payments component. The renderer process is not fully trusted in Chrome's multi-process security model, yet the Payments code accepted values from it without adequate constraints, enabling the spoof.
Attack Vector
Exploitation requires the attacker to first compromise the renderer process, typically by chaining a separate vulnerability such as a memory-safety bug in the rendering engine. Once inside the renderer, the attacker serves a crafted HTML page that triggers manipulated payment UI rendering. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for technical details.
Detection Methods for CVE-2026-17791
Indicators of Compromise
- Chrome browser processes running versions below 151.0.7922.72 after the vendor patch date
- Renderer process crashes or anomalies preceding user reports of unexpected payment prompts
- User reports of payment dialogs that display inconsistent merchant, currency, or amount details
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build earlier than 151.0.7922.72
- Correlate browser telemetry with process-injection or renderer-exploitation indicators, since this bug requires a prior renderer compromise
- Review web proxy logs for repeated visits to unknown domains initiating Payment Request API flows
Monitoring Recommendations
- Enable enterprise browser telemetry and forward events to a central analytics platform for version drift and exploitation signals
- Monitor endpoint process trees for child processes spawned by chrome.exe following payment activity
- Alert on browser update failures that leave hosts on vulnerable Chrome versions
How to Mitigate CVE-2026-17791
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
- Force restart of the browser after the update so the patched binary is loaded
- Audit any Chromium-based browsers in the environment and apply upstream fixes as they become available
Patch Information
Google addressed the issue in the Chrome Stable channel with version 151.0.7922.72. Details are provided in the Google Chrome Stable Update release notes and the corresponding Chromium Issue Tracker Entry.
Workarounds
- Enforce automatic Chrome updates through enterprise policy to eliminate manual patch delays
- Restrict use of browser-based payment flows on unpatched hosts until the update is deployed
- Educate users to verify transaction details on the merchant or issuer side before confirming payments
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
