CVE-2026-17840: Google Chrome XSS Vulnerability

CVE-2026-17840 Overview

CVE-2026-17840 is an incorrect security user interface (UI) vulnerability in the Passwords component of Google Chrome. Versions prior to 151.0.7922.72 are affected. A remote attacker can perform domain spoofing by serving a crafted HTML page to a target user. Chromium rates the security severity as Medium. The flaw resides in how Chrome presents password-related UI, enabling attackers to mislead users about the origin of a page or credential prompt.

Critical Impact
Attackers can trick users into disclosing credentials by spoofing the displayed domain in Chrome's Passwords UI, facilitating phishing and credential theft campaigns.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers that inherit the Passwords UI component
Desktop Stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE CVE-2026-17840 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17840

Vulnerability Analysis

The vulnerability is classified as an Incorrect Security UI issue, a category of user interface confusion flaws. Chrome's Passwords subsystem renders origin information used by users to verify the authenticity of a site requesting credentials. When a crafted HTML page manipulates this UI surface, the browser can display misleading domain indicators. Users relying on the visible origin to authorize a saved-password interaction may be deceived into trusting an attacker-controlled page.

The issue is remotely exploitable and requires only that a target loads attacker-supplied HTML. No memory corruption or code execution is implied by the advisory; the impact is confined to user deception and potential credential compromise.

Root Cause

The root cause is improper rendering or validation of origin data presented in the Passwords UI. Chromium tracks the defect under Chromium Issue #518082162. Full technical detail remains restricted while patch adoption progresses, per standard Chromium disclosure practice.

Attack Vector

An attacker hosts a crafted HTML page and lures a victim to visit it through phishing, malvertising, or a compromised site. When the page interacts with Chrome's password prompts or credential UI, the domain shown to the user does not match the actual origin driving the request. The victim may then submit stored or typed credentials believing the interaction is legitimate.

No verified proof-of-concept has been published. See the Google Chrome Stable Update announcement for vendor context.

Detection Methods for CVE-2026-17840

Indicators of Compromise

Outbound connections from Chrome to newly registered or lookalike domains preceding credential submissions.
Browser telemetry showing password autofill or manual credential entry on domains with low reputation scores.
User reports of Chrome password prompts appearing on unexpected pages.

Detection Strategies

Inventory Chrome installations and flag any build older than 151.0.7922.72 across managed endpoints.
Correlate web proxy logs with endpoint browser telemetry to identify visits to spoofed or homoglyph domains hosting login forms.
Alert on credential submissions to domains that do not appear on the organization's allow list of sanctioned services.

Monitoring Recommendations

Monitor DNS and TLS SNI logs for typosquatted variants of high-value corporate and SaaS domains.
Track Chrome version compliance through endpoint management tooling and generate exceptions for stale builds.
Ingest browser and proxy events into a centralized data lake to enable retrospective hunts once patch adoption is verified.

How to Mitigate CVE-2026-17840

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
Force-restart Chrome after update deployment to ensure the patched binary is loaded into memory.
Communicate phishing awareness guidance to users, emphasizing verification of URL bar contents before submitting credentials.

Patch Information

Google released the fix in the Chrome Stable channel update documented at the Google Chrome Stable Update announcement. Chromium-based browser vendors typically ship equivalent patches shortly after upstream releases; verify vendor advisories for Edge, Brave, Opera, and Vivaldi.

Workarounds

Enforce enterprise policy to disable password saving in Chrome until endpoints receive the patched version.
Deploy phishing-resistant authentication such as FIDO2 security keys to reduce impact of credential spoofing.
Restrict web browsing to categorized destinations through secure web gateway policies while patch rollout completes.

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query the installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv