CVE-2026-17833: Google Chrome Password Data Leak Flaw

CVE-2026-17833 Overview

CVE-2026-17833 is an inappropriate implementation vulnerability in the Passwords component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Google classified the Chromium security severity as Medium.

The flaw sits in the same-origin isolation logic surrounding Chrome's password functionality. Successful exploitation lets an attacker infer or read data that should remain confined to another web origin, breaking a fundamental browser security boundary.

Critical Impact
Remote attackers can leak cross-origin data via a crafted HTML page, undermining the same-origin policy that isolates sensitive site data in Chrome.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable Chrome code prior to milestone 151
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17833 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17833

Vulnerability Analysis

The vulnerability resides in Chrome's Passwords subsystem, which manages saved credentials, autofill, and password-related UI. An inappropriate implementation in this component fails to properly enforce cross-origin isolation. When a user loads a crafted HTML page controlled by an attacker, the page can trigger behavior in the Passwords component that exposes information tied to another origin.

Cross-origin data leaks in browser components typically enable an attacker to observe response sizes, timing signals, or state changes that reveal information about a victim's authenticated sessions on unrelated websites. The impact depends on what data the attacker can infer, but the class of flaw directly weakens the same-origin policy.

Google rates the Chromium security severity as Medium. The issue is tracked internally as Chromium Issue #517779123 and was addressed in the stable channel update announced by Google.

Root Cause

The root cause is an implementation error in the Passwords component that does not adequately isolate operations or state across web origins. Chrome relies on strict origin checks to prevent one site from observing data associated with another. In the affected code path, those checks are either missing, incorrectly applied, or bypassable through specific DOM interactions initiated from an attacker-controlled page.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page in a vulnerable Chrome build. The attacker hosts a page that interacts with the Passwords component in a way that induces cross-origin data disclosure. No privileged access is required, and the attack is fully remote. User interaction is limited to normal browsing.

Since no verified proof-of-concept is public, the exact DOM primitives and side channels used are not disclosed. Refer to the Chromium issue tracker entry once access restrictions are lifted for technical details.

Detection Methods for CVE-2026-17833

Indicators of Compromise

Chrome desktop clients reporting a version string below 151.0.7922.72 in browser telemetry or user-agent logs
Outbound requests from user endpoints to newly registered or low-reputation domains hosting HTML pages that repeatedly interact with password autofill APIs
Anomalous cross-origin fetches or postMessage traffic immediately following a page load on an untrusted site

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build prior to 151.0.7922.72
Correlate browser version data with web proxy logs to identify vulnerable clients visiting untrusted external pages
Monitor endpoint browser update status through management tooling and alert on stalled or failed updates

Monitoring Recommendations

Enable browser update telemetry in enterprise policy and centralize version reporting
Track visits to newly observed domains from endpoints running out-of-date Chrome versions
Review DLP logs for unexpected exfiltration patterns following user interaction with unfamiliar external pages

How to Mitigate CVE-2026-17833

Immediate Actions Required

Update Google Chrome desktop to version 151.0.7922.72 or later on all managed endpoints
Force a browser restart to ensure the patched binary is loaded, since Chrome only applies updates after relaunch
Verify update deployment through enterprise management consoles and remediate hosts that fail to update

Patch Information

Google released the fix in the Chrome stable channel update documented at the Google Chrome Desktop Update announcement. Users and administrators must ensure Chrome is at version 151.0.7922.72 or higher. Chromium-derived browsers should be updated once their maintainers merge the corresponding upstream fix.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patching completes
Disable Chrome's password autofill via the PasswordManagerEnabled enterprise policy on unpatched hosts as a temporary compensating control
Enforce strict site isolation and third-party cookie restrictions through Chrome enterprise policies to reduce cross-origin exposure

bash

# Configuration example: Chrome enterprise policy to disable password manager as a temporary workaround
# Windows registry (HKLM)
reg add "HKLM\Software\Policies\Google\Chrome" /v PasswordManagerEnabled /t REG_DWORD /d 0 /f

# macOS (plist)
defaults write com.google.Chrome PasswordManagerEnabled -bool false

# Linux (JSON policy)
# /etc/opt/chrome/policies/managed/passwords.json
# {
#   "PasswordManagerEnabled": false
# }