CVE-2026-17812: Google Chrome XSS Vulnerability

CVE-2026-17812 Overview

CVE-2026-17812 is a user interface (UI) spoofing vulnerability affecting the DigitalCredentials component in Google Chrome prior to version 151.0.7922.72. A remote attacker can exploit the flaw by serving a crafted HTML page, causing Chrome to render deceptive UI elements that misrepresent digital credential prompts to the user. Google has rated the Chromium security severity as Medium. The issue was addressed in the Stable Channel desktop update for Chrome 151.0.7922.72.

Critical Impact
A remote attacker can craft an HTML page that manipulates Chrome's DigitalCredentials UI to trick users into approving credential requests or misidentifying the origin of a prompt.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected DigitalCredentials implementation
All desktop platforms served by the Chrome Stable Channel

Discovery Timeline

2026-07-30 - CVE-2026-17812 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17812

Vulnerability Analysis

The vulnerability resides in Chrome's DigitalCredentials implementation, the browser subsystem that mediates requests for verifiable digital credentials between web origins and the user. An inappropriate implementation in this component allows a remote attacker to construct an HTML page that manipulates how the browser renders credential-related UI. Because the affected surface handles high-trust prompts, spoofing here undermines the user's ability to distinguish a legitimate credential request from an attacker-controlled one.

The NVD entry classifies this as a UI spoofing issue rather than a memory-corruption or code-execution flaw. Exploitation does not yield direct code execution in the renderer or browser process. Instead, it enables social engineering by presenting misleading origin, issuer, or consent information within a trusted-looking Chrome dialog.

Root Cause

The root cause is an inappropriate implementation in the DigitalCredentials API surface. Chrome fails to enforce the required constraints on how credential request UI is composed or displayed when driven by attacker-controlled HTML content. Boundaries between web-content-rendered elements and browser-chrome elements are not maintained consistently for this flow.

Attack Vector

Exploitation is remote and requires only that the victim visit a crafted web page. No authentication is required, and the attack leverages standard HTML delivered over HTTP or HTTPS. User interaction with the spoofed UI is required for meaningful impact, such as approving a credential prompt whose true origin or purpose has been misrepresented. Refer to the Chromium Issue #517101596 and the Google Chrome Desktop Update for the upstream tracking and release notes.

No public proof-of-concept code is available in the referenced sources, and no synthetic exploitation code is provided here.

Detection Methods for CVE-2026-17812

Indicators of Compromise

Chrome browser telemetry showing installed versions earlier than 151.0.7922.72 on managed endpoints.
Web proxy or DNS logs recording user navigation to unfamiliar domains immediately followed by digital credential presentation events.
User-reported prompts requesting digital credentials from sites that do not typically issue or consume them.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host below 151.0.7922.72 as exposed.
Correlate browser version data with URL categorization logs to identify users on vulnerable Chrome builds visiting uncategorized or newly registered domains.
Hunt for phishing pages that invoke the Digital Credentials API by inspecting HTTP responses for scripts referencing the navigator.identity or DigitalCredential interfaces from non-issuer origins.

Monitoring Recommendations

Enable enterprise Chrome policies that report browser version and update status to a centralized console.
Monitor endpoint browser update compliance daily and alert on stalled updates that leave hosts on pre-151.0.7922.72 builds.
Track user reports of unexpected credential prompts and route them into the phishing triage workflow.

How to Mitigate CVE-2026-17812

Immediate Actions Required

Update Google Chrome Desktop to version 151.0.7922.72 or later on all endpoints.
Force-restart Chrome on managed devices after the update is staged to ensure the patched binary is running.
Verify Chromium-based derivative browsers in the environment have pulled the corresponding upstream fix.

Patch Information

Google addressed CVE-2026-17812 in the Chrome Stable Channel release 151.0.7922.72, as documented in the Google Chrome Desktop Update announcement. The upstream fix is tracked in Chromium Issue #517101596. Administrators should confirm that Chrome auto-update is enabled and unblocked by network policy so that patched builds reach endpoints without delay.

Workarounds

Deploy enterprise policy to disable or restrict use of the Digital Credentials API where the feature is not required by business workflows.
Increase user awareness of digital credential prompt spoofing and instruct users to cancel any prompt whose requesting origin is unfamiliar.
Restrict browsing to categorized destinations via secure web gateway policy until patched Chrome builds are fully deployed.

bash

# Verify installed Chrome version on Windows, macOS, and Linux endpoints
# Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output must be 151.0.7922.72 or later