CVE-2026-17805: Google Chrome Auth Bypass Vulnerability

CVE-2026-17805 Overview

CVE-2026-17805 is a policy enforcement flaw in the Glic component of Google Chrome on Android. Versions prior to 151.0.7922.72 fail to enforce navigation restrictions correctly. A remote attacker can bypass these restrictions by serving a crafted HTML page to a targeted user. Chromium classifies the security severity as Medium.

The vulnerability requires user interaction, since the victim must load attacker-controlled content in Chrome for Android. Successful exploitation allows navigation to destinations that Chrome policy would otherwise block, expanding the attack surface for downstream phishing or exploit delivery.

Critical Impact
Remote attackers can bypass Chrome navigation policy on Android via a crafted HTML page, enabling redirection to attacker-chosen destinations without meeting Chrome's normal navigation constraints.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based Glic component on Android
Downstream Android browsers that embed vulnerable Chromium builds

Discovery Timeline

2026-07-30 - CVE-2026-17805 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17805

Vulnerability Analysis

The flaw resides in Glic, a component of Chrome on Android, and stems from insufficient policy enforcement around navigation. Chrome maintains restrictions that limit which URLs a page or embedded context can navigate to. Glic did not consistently apply these restrictions, allowing a crafted HTML page to trigger navigations that should have been denied.

Because the bypass targets navigation policy rather than memory safety, exploitation does not require arbitrary code execution primitives. The impact is scoped to the browser's security model on Android and does not, by itself, grant native code execution. The Chromium project rates the issue at Medium severity.

Root Cause

The root cause is missing or incomplete enforcement of navigation policy checks within Glic. When processing navigations initiated by a crafted HTML document, the component fails to validate the target against Chrome's expected policy constraints. This falls under Broken Access Control at the browser policy layer.

Attack Vector

Exploitation is remote and requires the victim to load a crafted HTML page in a vulnerable Chrome build on Android. The attacker hosts the page on infrastructure they control or delivers it via a compromised site, advertising network, or messaging link. Once loaded, the page triggers a navigation sequence that circumvents Glic's policy checks.

No authentication is required on the attacker's side. The primary constraint is user interaction, which is typical for browser-delivered exploits. Refer to the Chromium Issue Tracker Entry and the Google Chrome Release Update for vendor detail.

// No verified proof-of-concept code is published for CVE-2026-17805.
// See the Chromium Issue Tracker entry linked above for restricted technical detail.

Detection Methods for CVE-2026-17805

Indicators of Compromise

Chrome for Android clients reporting versions below 151.0.7922.72 in HTTP User-Agent telemetry
Outbound navigations from mobile browsers to domains not reachable via normal user workflow
Repeated redirects originating from a single crafted landing page hosted on suspicious infrastructure

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag builds prior to 151.0.7922.72
Correlate web proxy logs for unusual navigation chains that terminate at credential harvesting or exploit-kit domains
Monitor mobile threat defense telemetry for anomalous browser navigation events tied to unmanaged HTML content

Monitoring Recommendations

Ingest mobile browser version data into the security data lake and alert on outdated Chrome for Android builds
Track newly registered domains delivering HTML that triggers multi-step redirects to sensitive targets
Enable phishing and URL reputation monitoring on mobile egress paths

How to Mitigate CVE-2026-17805

Immediate Actions Required

Update Google Chrome on Android to 151.0.7922.72 or later through Google Play
Enforce a minimum Chrome version policy through mobile device management (MDM) for corporate Android fleets
Communicate the update requirement to users who manage personal Android devices used for work

Patch Information

Google addressed the issue in Chrome for Android 151.0.7922.72. Details are published in the Google Chrome Release Update. The corresponding Chromium bug is tracked in the Chromium Issue Tracker Entry and remains access-restricted while user adoption of the fix progresses.

Workarounds

Restrict browsing to trusted sites until the Chrome update is deployed across Android endpoints
Use MDM policy to block installation of Chrome versions older than 151.0.7922.72
Route mobile browser traffic through a filtering proxy that blocks known malicious HTML delivery domains

bash

# Query managed Android devices for outdated Chrome builds via MDM API (example pattern)
mdmctl devices list --app com.android.chrome --version-lt 151.0.7922.72