CVE-2026-17799: Google Chrome Auth Bypass Vulnerability

CVE-2026-17799 Overview

CVE-2026-17799 is an input validation vulnerability in the Safe Browsing component of Google Chrome prior to version 151.0.7922.72. A remote attacker can bypass discretionary access control by serving a malicious file to a targeted user. Google's Chromium project rated the security severity as Medium. The weakness maps to [CWE-20: Improper Input Validation]. The flaw undermines a browser security boundary specifically designed to warn users about dangerous downloads, allowing attacker-controlled files to reach the endpoint without expected safeguards.

Critical Impact
A remote attacker can deliver a malicious file that bypasses Safe Browsing's discretionary access control, exposing users to unrestricted download and execution paths.

Affected Products

Google Chrome Desktop prior to 151.0.7922.72
Chromium-based builds sharing the pre-patch Safe Browsing component
Downstream browsers integrating the affected Chromium release channel

Discovery Timeline

2026-07-30 - CVE-2026-17799 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17799

Vulnerability Analysis

The vulnerability lives inside Chrome's Safe Browsing subsystem, which inspects downloads and navigations against reputation and policy checks. Safe Browsing insufficiently validates untrusted input, causing the enforcement logic to accept file content or metadata it should reject. The result is a bypass of discretionary access control that Chrome normally applies to downloaded files. An attacker hosting a malicious file on an attacker-controlled site can deliver that file to a victim who visits the page. The bypass removes protective friction, such as blocking prompts or execution restrictions, that Safe Browsing normally enforces on files marked as risky.

Root Cause

The root cause is improper validation of untrusted input consumed by Safe Browsing. The component trusts attribute-level data supplied through the malicious file or its delivery context. Because those inputs feed into access-control decisions without adequate sanitization, an attacker can craft values that steer the check toward an allow decision. This behavior is classified under [CWE-20].

Attack Vector

Exploitation is remote and requires user interaction limited to visiting an attacker-controlled resource or receiving a crafted file. No authentication is required on the target browser. The attacker delivers the malicious file through standard web download flows. Once Safe Browsing misclassifies the file, downstream discretionary access control checks that rely on that classification are bypassed. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for advisory context. Verified proof-of-concept code is not publicly available at this time.

Detection Methods for CVE-2026-17799

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints.
Unexpected downloads landing in user directories without Safe Browsing prompts or mark-of-the-web tagging.
Outbound connections to newly registered domains immediately preceding file writes from chrome.exe.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72.
Correlate browser download events with subsequent process executions from user-writable paths.
Alert on downloads of high-risk file types where the browser download telemetry lacks Safe Browsing verdict metadata.

Monitoring Recommendations

Ingest browser telemetry, endpoint process creation logs, and web proxy download logs into a central analytics platform.
Monitor for child processes spawned by chrome.exe shortly after file download events.
Track user reports of missing Safe Browsing warnings on files known to be flagged historically.

How to Mitigate CVE-2026-17799

Immediate Actions Required

Update Google Chrome to 151.0.7922.72 or later on all supported platforms.
Force-restart browser sessions after patch deployment to ensure the updated Safe Browsing component loads.
Audit endpoints for stale Chrome installs and remove unmanaged copies where possible.

Patch Information

Google released the fix in the Chrome Stable channel version 151.0.7922.72. Deployment details are available in the Google Chrome Update Announcement. Chromium-based browser vendors should integrate the corresponding upstream commit referenced in the Chromium Issue Tracker Entry.

Workarounds

Enforce enterprise download restrictions through Chrome policies such as DownloadRestrictions to block executables and dangerous file types.
Restrict execution from user-writable directories using application control on managed endpoints.
Educate users to treat unexpected downloads as suspicious even when no browser warning is displayed.

bash

# Chrome Enterprise policy example: block dangerous downloads until patch is verified
# Windows registry path: HKLM\Software\Policies\Google\Chrome
# macOS plist: com.google.Chrome
DownloadRestrictions = 3   # Block all potentially dangerous file types
SafeBrowsingProtectionLevel = 2   # Enable Enhanced Safe Browsing