CVE-2026-17821: Google Chrome Extension Auth Bypass Flaw

CVE-2026-17821 Overview

CVE-2026-17821 is an insufficient policy enforcement vulnerability in the Extensions component of Google Chrome. The flaw affects versions prior to 151.0.7922.72. An attacker who convinces a user to install a malicious extension can bypass navigation restrictions through a crafted Chrome Extension. Google classifies the Chromium security severity as Medium.

The vulnerability requires user interaction, specifically the installation of an attacker-controlled extension. Once installed, the extension circumvents browser-enforced navigation policies designed to restrict where extensions can direct users.

Critical Impact
A malicious Chrome extension can bypass navigation restrictions, enabling redirection to attacker-controlled destinations and undermining browser security policies intended to protect users from unwanted navigation.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers sharing the same extensions codebase
Desktop Stable Channel builds released before the fix

Discovery Timeline

2026-07-30 - CVE-2026-17821 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17821

Vulnerability Analysis

The vulnerability resides in Chrome's Extensions subsystem, which enforces policies governing how extensions interact with browser navigation. Chrome maintains a permission model that limits extension capabilities and restricts navigation to specific origins or contexts. Insufficient enforcement of these policies allows a crafted extension to bypass the intended restrictions.

Exploitation depends on a social engineering step: the user must install the malicious extension, whether from the Chrome Web Store, a sideloaded package, or another distribution channel. After installation, the extension leverages the policy gap to trigger navigations that Chrome should have blocked or constrained.

Google rated the Chromium security severity as Medium. The bug class aligns with Broken Access Control in browser extension policy enforcement.

Root Cause

The root cause is inadequate validation or enforcement within the code path that governs extension-initiated navigations. Chrome's extension APIs should apply origin and context checks before permitting navigation, and this vulnerability indicates a gap in that logic. Public technical details remain limited pending broader patch adoption. Refer to the Chromium Issue Tracker Entry for restricted engineering context.

Attack Vector

The attack requires the victim to install a malicious Chrome extension. Distribution channels include the Chrome Web Store (if the extension evades review), enterprise sideloading, developer mode installations, and social engineering campaigns that impersonate legitimate tools. Once active, the extension issues crafted API calls that trigger navigation to destinations otherwise restricted by browser policy.

The vulnerability is described in prose only because no verified proof-of-concept code is publicly available. Consult the Google Chrome Update Announcement for the vendor's disclosure.

Detection Methods for CVE-2026-17821

Indicators of Compromise

Chrome installations reporting a version earlier than 151.0.7922.72 in enterprise inventory data
Newly installed browser extensions from unknown publishers or with excessive permissions such as webNavigation, tabs, or broad host permissions
Unexpected browser navigations to unfamiliar domains initiated shortly after extension installation

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and compare against an allowlist of approved IDs
Correlate extension installation events with subsequent outbound network connections to previously unseen domains
Monitor Chrome policy telemetry (via chrome://policy or enterprise reporting) for extensions with navigation-related permissions

Monitoring Recommendations

Enable Chrome Enterprise Reporting to collect extension install and update events
Alert on Chrome browser versions falling behind the current Stable Channel across the fleet
Review DNS and proxy logs for browser-initiated redirects toward known malicious or newly registered domains

How to Mitigate CVE-2026-17821

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Audit currently installed extensions and remove any that are unapproved or request webNavigation and broad host permissions without justification
Restrict extension installation to an enterprise-managed allowlist using Chrome Enterprise policy

Patch Information

Google released the fix in the Stable Channel update to 151.0.7922.72. Details are available in the Google Chrome Update Announcement. Chromium-based browsers should apply the corresponding upstream patch referenced in the Chromium Issue Tracker Entry.

Workarounds

Configure the ExtensionInstallBlocklist policy to * and use ExtensionInstallAllowlist to permit only vetted extension IDs
Disable developer mode extensions on managed devices via the DeveloperToolsAvailability policy
Educate users to avoid installing extensions from outside the corporate allowlist until patches are deployed

bash

# Configuration example: Chrome Enterprise policy (Windows registry)
# Block all extensions except explicitly allowed IDs
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f