CVE-2026-17825: Google Chrome Auth Bypass Vulnerability

CVE-2026-17825 Overview

CVE-2026-17825 is an insufficient policy enforcement vulnerability in the Passwords component of Google Chrome on Android. Versions prior to 151.0.7922.72 allow a remote attacker to bypass discretionary access control through a crafted HTML page. Google's Chromium project rated this issue as Medium severity.

The flaw affects how Chrome's password subsystem enforces access policies on Android, permitting an attacker-controlled page to reach password-related functionality that should be restricted. Successful exploitation requires the target to visit a malicious page in a vulnerable Chrome build.

Critical Impact
A crafted HTML page can bypass discretionary access control in Chrome's password management on Android, potentially exposing stored credentials or password-related actions to attacker-controlled web content.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based mobile browsers sharing the affected password policy code
Android devices with vulnerable Chrome versions installed

Discovery Timeline

2026-07-30 - CVE-2026-17825 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17825

Vulnerability Analysis

The vulnerability resides in the Passwords component of Google Chrome on Android. Chrome enforces discretionary access control (DAC) policies that determine which origins and contexts can interact with stored credentials and password-related UI. In affected builds, these checks are incomplete or improperly applied.

A remote attacker who convinces a user to load a crafted HTML page can leverage the gap to reach functionality that policy should have blocked. Because the issue is triggered from web content, no privileged position on the device is required. User interaction is limited to visiting the attacker-controlled page.

Google classifies the issue as Medium severity within Chromium's internal rating system. The vendor addressed the flaw in Chrome 151.0.7922.72 for Android.

Root Cause

The root cause is insufficient enforcement of policy checks around Passwords on Android. Access control decisions rely on validation that does not fully cover the paths reachable from web content. As a result, a malicious page can influence behavior that should require the appropriate origin, user gesture, or Android-level authorization.

Attack Vector

The attack vector is remote and web-based. An attacker hosts a crafted HTML page and lures the victim to visit it in a vulnerable Chrome build on Android. When the page loads, it exercises the DAC bypass to interact with password functionality outside the intended policy boundary.

No verified proof-of-concept has been published. Technical specifics remain restricted while users update. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for vendor references.

Detection Methods for CVE-2026-17825

Indicators of Compromise

Android devices running Chrome versions earlier than 151.0.7922.72
Browser navigation events to untrusted URLs immediately followed by unexpected password autofill or password manager prompts
Anomalous outbound traffic from mobile endpoints correlated with credential-related events

Detection Strategies

Inventory Chrome for Android versions across managed mobile fleets using MDM or UEM telemetry
Flag any Chrome on Android build below 151.0.7922.72 as non-compliant
Correlate browser telemetry with identity provider logs to detect unusual credential submission patterns following browsing activity

Monitoring Recommendations

Ingest mobile browser and MDM logs into a centralized analytics platform for version compliance monitoring
Watch identity provider logs for atypical logins from mobile user agents shortly after risky browsing sessions
Alert on repeated password autofill prompts originating from newly observed or low-reputation domains

How to Mitigate CVE-2026-17825

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce mobile browser update policies via MDM to prevent users from remaining on vulnerable builds
Advise users to avoid interacting with password prompts on unfamiliar or untrusted websites until updates are applied

Patch Information

Google released the fix in Chrome 151.0.7922.72 for Android. Users and administrators should verify the installed version in Chrome settings under About Chrome. See the Google Chrome Desktop Update release note and the Chromium Issue Tracker Entry for vendor details.

Workarounds

Restrict use of Chrome on Android for high-risk users until the patched version is deployed
Disable password autofill in Chrome on Android via enterprise policy where operationally feasible
Route mobile browsing through security controls that block known malicious domains and credential-harvesting pages

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=151.0.7922.72 or higher