CVE-2026-17817: Google Chrome Information Disclosure Flaw

CVE-2026-17817 Overview

CVE-2026-17817 is an inappropriate implementation vulnerability in the ReportingAndNEL (Reporting API and Network Error Logging) component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user.

Chromium classifies the security severity as Medium. Exploitation requires user interaction, specifically navigation to attacker-controlled content. The flaw undermines the browser's same-origin policy by exposing information from other origins through the reporting subsystem.

Critical Impact
A crafted web page can leak cross-origin data from a victim's browser session, exposing information that should remain isolated between origins.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers that inherit the ReportingAndNEL implementation
All supported desktop platforms (Windows, macOS, Linux) prior to the fixed build

Discovery Timeline

2026-07-30 - CVE-2026-17817 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17817

Vulnerability Analysis

The vulnerability resides in Chrome's Reporting API and Network Error Logging (NEL) subsystem, collectively referenced as ReportingAndNEL. These features allow web origins to receive reports about network errors, deprecation notices, and policy violations experienced by clients. When the reporting pipeline improperly handles data associated with cross-origin requests or navigations, information intended to remain isolated to one origin can be observed by another.

The advisory describes the issue as an inappropriate implementation, indicating a logic flaw rather than memory corruption. An attacker hosts a crafted HTML page that induces the browser to generate reports or process network events in a way that discloses data from a different origin. This class of bug typically bypasses the same-origin policy through side effects in a supporting browser subsystem.

Root Cause

The root cause is improper enforcement of origin boundaries within the Reporting API and NEL code paths in Chrome versions prior to 151.0.7922.72. Data flowing through the reporting mechanism was not correctly scoped to the originating context, permitting a foreign origin to observe details it should not receive.

Attack Vector

Exploitation requires a remote attacker to lure a victim to a crafted HTML page. The page contains markup or resource loads that trigger the reporting pathway in a way that leaks cross-origin information back to attacker-controlled infrastructure. No authentication is required, and the attacker does not need direct access to the target system. See the Chromium Issue Tracker Entry and the Google Chrome Update Notice for vendor context.

No verified proof-of-concept code has been published for CVE-2026-17817.
See the Chromium issue tracker for technical details once access is granted.

Detection Methods for CVE-2026-17817

Indicators of Compromise

Outbound HTTP POST requests to unfamiliar endpoints containing Content-Type: application/reports+json from Chrome clients running versions earlier than 151.0.7922.72.
Web pages that set unusual Report-To, Reporting-Endpoints, or NEL response headers pointing to attacker-controlled collectors.
Browser telemetry showing reporting deliveries correlated with visits to previously unseen domains.

Detection Strategies

Inventory Chrome and Chromium-derived browser versions across managed endpoints and flag any build earlier than 151.0.7922.72.
Inspect proxy and DNS logs for connections to domains that appear only in response to a specific page load and that receive JSON report bodies.
Alert on newly observed Reporting-Endpoints or Report-To header values in monitored HTTP traffic.

Monitoring Recommendations

Correlate browsing history with egress traffic to identify report deliveries that follow visits to low-reputation sites.
Track Chrome update compliance through endpoint management tooling and generate exceptions for stale installations.
Review web content filtering logs for high-risk categories serving pages that instrument the Reporting API.

How to Mitigate CVE-2026-17817

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after applying the update to ensure the patched binary is active; pending updates do not take effect until relaunch.
Force policy-managed browser updates through enterprise management tooling to close the window of exposure.

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Google Chrome Update Notice. Users on the Stable channel receive the fix by upgrading to 151.0.7922.72 or later. Downstream Chromium-based browsers should apply their vendor's equivalent release once available.

Workarounds

Restrict browsing to trusted sites through web content filtering until all endpoints are updated.
Use enterprise policy to disable or constrain the Reporting API where operationally acceptable until patch deployment completes.
Deploy browser isolation for high-risk user populations that cannot be updated immediately.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS endpoints
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv