CVE-2026-17829: Google Chrome Information Disclosure Flaw

CVE-2026-17829 Overview

CVE-2026-17829 is an insufficient policy enforcement vulnerability in the Passwords component of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Google Chrome tracks this issue with a Chromium security severity rating of Medium.

The flaw undermines browser policy controls that separate content across origins. Successful exploitation exposes password-related data that should remain isolated by the same-origin policy.

Critical Impact
A remote attacker can leak cross-origin data from the Passwords component via a crafted HTML page, bypassing browser policy enforcement.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected Passwords component
Desktop Stable channel builds updated by the July 2026 release cycle

Discovery Timeline

2026-07-30 - CVE-2026-17829 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17829

Vulnerability Analysis

The vulnerability resides in the Passwords subsystem of Google Chrome. Insufficient policy enforcement allows a crafted HTML page to obtain cross-origin data that should be blocked by browser isolation controls. This class of issue typically involves gaps between the Passwords feature logic and the same-origin policy applied to page contexts.

Exploitation requires the target user to load an attacker-controlled page. Once loaded, the page can read data across origin boundaries that the Passwords component should protect. The result is disclosure of information tied to other sites in the user's browsing session.

Root Cause

The root cause is inadequate enforcement of security policies inside the Passwords feature. The component fails to consistently apply origin restrictions when processing certain interactions initiated from an HTML page. Google's advisory categorizes this under insufficient policy enforcement rather than a memory safety defect.

Attack Vector

The attack is remote and requires user interaction limited to visiting a page. An attacker hosts a crafted HTML document and lures the victim through phishing, malvertising, or a compromised site. No authentication is required. Because the flaw sits in a widely deployed browser component, any workstation running an unpatched Chrome build is a candidate target.

No verified proof-of-concept code is available at this time. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor-provided technical detail as it becomes public.

Detection Methods for CVE-2026-17829

Indicators of Compromise

Chrome processes loading unexpected HTML pages followed by outbound connections to unfamiliar domains shortly after Passwords UI interaction
Browser telemetry showing user visits to newly registered or low-reputation domains delivering HTML payloads
Endpoint records of Chrome versions below 151.0.7922.72 still running after patch availability

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag builds earlier than 151.0.7922.72
Correlate web proxy logs with Chrome browsing telemetry to identify visits to suspicious HTML resources
Monitor for anomalous credential reuse or account access patterns that could indicate leaked cross-origin data

Monitoring Recommendations

Ingest browser version data into your asset management and vulnerability platforms for continuous exposure tracking
Alert on Chrome update failures or delayed patch rollouts on user endpoints
Track outbound DNS and HTTP requests from browser processes to detect exfiltration attempts

How to Mitigate CVE-2026-17829

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints
Restart the browser after update to ensure the patched binaries are loaded
Verify enterprise deployment tooling has pushed the patched build to all managed devices

Patch Information

Google released the fix in Chrome Stable channel version 151.0.7922.72. See the Google Chrome Update Announcement for the full release notes and the Chromium Issue Tracker Entry for the tracked issue. Chromium-based browsers should apply their vendor's corresponding update once released.

Workarounds

Enforce automatic Chrome updates via enterprise policy to reduce time-to-patch
Restrict access to untrusted websites through web filtering while updates propagate
Advise users to avoid clicking links from unsolicited emails or messages until patching completes

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows registry check for installed Chrome version
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv