CVE-2026-17824: Google Chrome Auth Bypass Vulnerability

CVE-2026-17824 Overview

CVE-2026-17824 is a same-origin policy bypass in the ServiceWorker component of Google Chrome. Versions prior to 151.0.7922.72 insufficiently enforce policy checks, allowing a remote attacker to bypass same-origin restrictions through a crafted HTML page. Chromium rates the security severity as Medium.

The flaw is triggered when a victim loads attacker-controlled HTML in the browser. Successful exploitation lets a malicious origin read or manipulate resources belonging to another origin, breaking one of the browser's core web isolation guarantees.

Critical Impact
A crafted HTML page can bypass the same-origin policy through ServiceWorker, exposing cross-origin data and enabling account or session compromise.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable ServiceWorker implementation
Downstream builds using Chromium releases before the stable channel fix

Discovery Timeline

2026-07-30 - CVE-2026-17824 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17824

Vulnerability Analysis

The vulnerability resides in Chrome's ServiceWorker subsystem, which mediates network requests, caching, and background scripts for web origins. Insufficient policy enforcement in this component permits requests or responses to cross origin boundaries that the same-origin policy should block.

Browsers rely on the same-origin policy as the foundational isolation mechanism between web applications. When a ServiceWorker fails to fully validate origin context on intercepted requests, attackers can leverage the worker as a relay to observe or influence cross-origin traffic. The attack requires only that a victim visit a page under attacker control.

The outcome is a broken security boundary. An attacker can read data intended for another origin, forge cross-origin actions, or exfiltrate authenticated content from sites the victim is signed into.

Root Cause

The root cause is insufficient policy enforcement within ServiceWorker request handling. The component does not consistently apply same-origin checks along all code paths that produce or consume cross-origin resources. See Chromium Issue Tracker #517655543 for the tracked defect.

Attack Vector

Exploitation is remote and requires user interaction limited to visiting a crafted HTML page. The attacker hosts a page that registers or interacts with a ServiceWorker in a way that induces the browser to treat cross-origin data as same-origin. No authentication or elevated privileges are required on the target.

No verified public proof-of-concept code is referenced in the advisory. Technical details are limited to the Chrome stable channel release notes and the Chromium issue tracker entry.

Detection Methods for CVE-2026-17824

Indicators of Compromise

Unexpected ServiceWorker registrations in browser storage referencing untrusted origins
Outbound requests from user endpoints to newly registered domains hosting sw.js or similar worker scripts immediately after browsing activity
Chrome process versions below 151.0.7922.72 observed in endpoint inventory after the patch release

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor web proxy and DNS logs for connections to low-reputation domains that serve ServiceWorker scripts
Correlate browser telemetry with authentication anomalies on internal web applications that may indicate cross-origin session abuse

Monitoring Recommendations

Enable browser management telemetry through Chrome Enterprise or equivalent to track version compliance
Alert on user reports of unexpected authentication prompts or session behavior after visiting external sites
Review endpoint detection logs for browser child processes exhibiting unusual network patterns tied to worker registrations

How to Mitigate CVE-2026-17824

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after deployment to activate the patched binary and clear vulnerable worker registrations
Audit ServiceWorker storage on high-risk user profiles and clear registrations from untrusted origins

Patch Information

Google released the fix in the Chrome stable channel at version 151.0.7922.72. Deployment details are available in the Google Chrome Desktop Update announcement. Chromium-based browser vendors should integrate the upstream fix and ship a corresponding update.

Workarounds

Restrict browsing to trusted sites via enterprise URL allowlists until patching completes
Disable ServiceWorker for untrusted origins through Chrome Enterprise policy where operationally feasible
Clear existing ServiceWorker registrations using chrome://serviceworker-internals on shared or high-risk devices

bash

# Configuration example
# Chrome Enterprise policy to block ServiceWorker on untrusted origins
# /etc/opt/chrome/policies/managed/serviceworker_policy.json
{
  "DefaultServiceWorkerSetting": 2,
  "ServiceWorkerAllowedForUrls": [
    "https://[*.]corp.example.com"
  ]
}