CVE-2026-17792: Google Chrome XSS Vulnerability

CVE-2026-17792 Overview

CVE-2026-17792 is a user interface spoofing vulnerability in the Credential Management component of Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72 and stems from an inappropriate implementation in how credential management prompts are rendered. A remote attacker can exploit this issue by serving a crafted HTML page that manipulates the browser's credential UI. Google's Chromium security team rated the severity as Medium. Successful exploitation enables attackers to deceive users into disclosing or misusing stored credentials by presenting misleading interface elements.

Critical Impact
Remote attackers can craft HTML pages that spoof Chrome credential prompts, tricking users into interacting with attacker-controlled UI elements and potentially exposing stored account credentials.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers sharing the vulnerable Credential Management implementation
Stable channel Chrome releases across Windows, macOS, and Linux

Discovery Timeline

2026-07-30 - CVE-2026-17792 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17792

Vulnerability Analysis

The vulnerability resides in Chrome's Credential Management API implementation. This component handles browser-mediated credential storage, retrieval, and account chooser prompts. An inappropriate implementation allows a crafted HTML page to influence how credential-related UI elements are presented to the user.

UI spoofing attacks abuse the trust boundary between browser chrome and web content. When credential prompts can be visually manipulated by page content, users cannot reliably distinguish legitimate browser dialogs from attacker-controlled overlays. This undermines a core security assumption of password managers and federated login flows.

Details on the specific rendering or event-handling defect are tracked in the Chromium Issue Tracker Entry, which remains access-restricted during the standard disclosure window.

Root Cause

The root cause is an inappropriate implementation within the Credential Management subsystem. The component fails to enforce adequate separation between page-controlled content and privileged credential UI. This category of defect is classified as User Interface Confusion and typically maps to weaknesses in origin display, z-order handling, or dialog timing.

Attack Vector

Exploitation requires the victim to visit a crafted HTML page. The attacker constructs page content that manipulates the layout, timing, or rendering of Chrome's credential prompts. No authentication is required, and the attack is delivered entirely over the network through standard web content. See the Google Chrome Desktop Update advisory for the vendor announcement.

No verified public exploit code is available for this vulnerability. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-17792

Indicators of Compromise

Web traffic to untrusted domains immediately followed by credential submission events in browser telemetry
Chrome browser versions below 151.0.7922.72 observed in endpoint inventory data
User reports of unexpected credential prompts, account chooser dialogs, or password save banners on unfamiliar sites

Detection Strategies

Inventory Chrome installations across the environment and flag any instance running a build older than 151.0.7922.72
Monitor phishing feeds and DNS logs for domains hosting credential-harvesting pages targeting Chrome users
Correlate browser process telemetry with subsequent authentication anomalies against corporate identity providers

Monitoring Recommendations

Enable browser management policies that report installed Chrome versions to a central console
Ingest endpoint and web proxy logs into a centralized data lake for cross-source correlation of suspicious credential activity
Track authentication failure spikes that may indicate credentials harvested through UI spoofing were replayed against corporate services

How to Mitigate CVE-2026-17792

Immediate Actions Required

Update all Google Chrome Desktop installations to version 151.0.7922.72 or later
Verify that Chrome auto-update is enabled and functioning on managed endpoints
Restart Chrome after the update to ensure the patched binaries are loaded into memory

Patch Information

Google released the fix in the Stable channel update documented in the Google Chrome Desktop Update advisory. The patched version is 151.0.7922.72. Chromium-based browser vendors typically follow with equivalent updates; verify vendor advisories for downstream products such as Microsoft Edge, Brave, and Opera.

Workarounds

Deploy enterprise policy to disable password saving in Chrome until the update is verified across the fleet
Educate users to verify the origin bar and avoid entering credentials when prompts appear on unexpected pages
Use a dedicated password manager with autofill restricted to verified origins to reduce reliance on browser-native credential prompts

bash

# Verify installed Chrome version on Linux and macOS endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force policy-based minimum version via Chrome Enterprise (JSON policy fragment)
# Place in the ManagedChromePolicy configuration store
# {
#   "MinimumChromeVersion": "151.0.7922.72"
# }