CVE-2026-17797 Overview
CVE-2026-17797 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome caused by an inappropriate implementation in the browser's CSS handling. Versions of Chrome prior to 151.0.7922.72 are affected. A remote attacker can inject arbitrary scripts or HTML into the rendering context of another origin by convincing a user to visit a crafted HTML page. Google's Chromium security team rated the underlying issue as Medium severity. The flaw is a client-side injection vector that undermines the browser's same-origin protections through CSS-driven behavior rather than direct script execution.
Critical Impact
A crafted web page can bypass same-origin boundaries and execute attacker-controlled scripts or HTML in the context of arbitrary origins the victim visits.
Affected Products
- Google Chrome for Desktop prior to 151.0.7922.72
- Chromium-based browsers incorporating the vulnerable CSS implementation
- Downstream distributions embedding pre-151 Chromium builds
Discovery Timeline
- 2026-07-30 - CVE-2026-17797 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17797
Vulnerability Analysis
The vulnerability resides in Chrome's CSS subsystem, where an inappropriate implementation allows attacker-controlled content to breach the boundary between rendering and script execution contexts. This class of flaw is categorized as Universal Cross-Site Scripting (UXSS), meaning the injection is not confined to a single vulnerable site. Instead, the browser itself carries the attacker payload across origins. A remote attacker who serves a crafted HTML page to a victim can cause arbitrary scripts or HTML to run in the security context of other web origins loaded by that user. The consequences include session theft, credential harvesting, silent data exfiltration, and unauthorized actions on any authenticated site accessed during the browsing session.
Root Cause
The root cause is an inappropriate implementation in the CSS engine of Chrome versions prior to 151.0.7922.72. Because the flaw affects how CSS is processed at the engine level, standard site-side XSS filters and Content Security Policy directives cannot fully compensate. The Chromium project tracks the underlying issue at Chromium Issue Tracker Entry.
Attack Vector
Exploitation requires only that a victim load a crafted HTML page in a vulnerable Chrome build. No privileged access or authentication is needed on the target site. Delivery vectors include phishing links, malicious advertisements, compromised third-party scripts, and watering-hole pages. Once the crafted page loads, the CSS implementation flaw enables the attacker to inject scripts or HTML that execute across origin boundaries. See the Google Chrome Update Blog for the corresponding Stable channel advisory.
Detection Methods for CVE-2026-17797
Indicators of Compromise
- Chrome browser processes reporting a version string below 151.0.7922.72 in enterprise inventory data.
- Outbound web traffic to newly registered or low-reputation domains immediately followed by anomalous requests to authenticated sites in the same browser session.
- Unexpected DOM modifications or script executions on trusted sites captured by browser telemetry or web application logs.
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any endpoint below 151.0.7922.72.
- Correlate browser process telemetry with proxy logs to identify sessions that transition from suspicious pages to authenticated corporate applications.
- Monitor web application logs for atypical request patterns, such as authenticated actions originating immediately after cross-origin referrers.
Monitoring Recommendations
- Ingest browser and endpoint version data into a central log platform for continuous version compliance checks.
- Track user-reported browser anomalies and correlate with URL categorization data from web proxies.
- Alert on Chrome processes launching from or navigating to domains flagged by threat intelligence feeds.
How to Mitigate CVE-2026-17797
Immediate Actions Required
- Update all Google Chrome installations to 151.0.7922.72 or later on Windows, macOS, and Linux endpoints.
- Force-close and relaunch Chrome after applying the update to ensure the patched binaries are loaded.
- Apply equivalent updates to any Chromium-based browsers that inherit the affected CSS code.
Patch Information
Google addressed CVE-2026-17797 in the Chrome Stable channel release 151.0.7922.72. Details of the release are published in the Google Chrome Update Blog. Administrators managing Chrome through enterprise policy should confirm that automatic updates are enabled and that the update channel is set to Stable.
Workarounds
- Restrict browsing on unpatched endpoints to trusted internal sites until the update is deployed.
- Enforce enterprise policies that block execution of Chrome versions below 151.0.7922.72 via application control.
- Deploy web filtering to block known malicious domains that host crafted HTML pages targeting browser vulnerabilities.
# Verify installed Chrome version on Linux/macOS
google-chrome --version
# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
