CVE-2026-17842: Chrome for iOS XSS Vulnerability

CVE-2026-17842 Overview

CVE-2026-17842 is a same-origin policy bypass in Google Chrome for iOS versions prior to 151.0.7922.72. The vulnerability results from an inappropriate implementation in the Chrome for iOS codebase. A remote attacker can exploit the flaw by hosting a crafted HTML page and convincing a user to perform specific user interface gestures. Successful exploitation allows the attacker to bypass the same-origin policy, a foundational browser security boundary that isolates content between origins. Google classified the Chromium security severity as Medium.

Critical Impact
Attackers can circumvent same-origin policy protections on iOS Chrome, potentially exposing cross-origin data such as authenticated session content or DOM contents from unrelated websites.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Web applications relying on browser-enforced origin isolation

Discovery Timeline

2026-07-30 - CVE-2026-17842 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17842

Vulnerability Analysis

The vulnerability resides in Chrome for iOS and stems from an inappropriate implementation that fails to correctly enforce the same-origin policy (SOP). The same-origin policy prevents scripts loaded from one origin from reading data or interacting with resources served from a different origin. When this boundary breaks, an attacker-controlled page can access data belonging to other websites the victim is authenticated to.

Exploitation requires user interaction. The attacker must convince the target to perform specific UI gestures on a crafted HTML page. This user interaction requirement lowers the practical exploitability but does not eliminate risk, as social engineering, malvertising, or search engine poisoning can direct users to malicious pages.

Root Cause

The root cause is a logic flaw in how Chrome for iOS handles origin enforcement during certain UI-driven navigation or rendering flows. Chrome for iOS uses Apple's WKWebView engine due to Apple platform requirements, so origin enforcement paths differ from desktop Chromium. The specific implementation error allowed an attacker page to interact with cross-origin content outside SOP constraints.

Attack Vector

The attack chain begins with a victim visiting a crafted HTML page in vulnerable Chrome for iOS. The page executes JavaScript that stages the SOP bypass. The attacker prompts the victim to perform a specific interaction, such as a tap, drag, or gesture on a visible element. Upon that gesture, the crafted page accesses or manipulates content from a different origin. Detailed exploitation mechanics are referenced in the Chromium Issue Tracker Entry and the Google Chrome Desktop Update.

Detection Methods for CVE-2026-17842

Indicators of Compromise

Chrome for iOS clients reporting a User-Agent version string below 151.0.7922.72 in web server logs
Unexpected cross-origin postMessage, fetch, or XMLHttpRequest activity originating from mobile Chrome sessions
Users reporting unexpected UI prompts, overlays, or gesture requests on unfamiliar pages

Detection Strategies

Inventory Chrome for iOS versions across managed mobile devices using Mobile Device Management (MDM) telemetry
Correlate web application access logs with outdated Chrome iOS User-Agent strings to identify at-risk sessions
Monitor web traffic for HTML pages hosting suspicious gesture-based interaction patterns paired with cross-origin script activity

Monitoring Recommendations

Alert on authenticated sessions accessed by Chrome for iOS builds older than 151.0.7922.72
Track anomalous access patterns to high-value web applications from mobile browsers
Review MDM compliance dashboards for pending Chrome updates on iOS fleets

How to Mitigate CVE-2026-17842

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Push the updated Chrome version to managed iOS devices via MDM policies
Communicate the update requirement to end users who install Chrome outside managed profiles

Patch Information

Google addressed CVE-2026-17842 in Chrome for iOS 151.0.7922.72. Refer to the Google Chrome Desktop Update release channel notes and the Chromium Issue Tracker Entry for the corresponding fix references.

Workarounds

Use an alternate up-to-date browser on iOS until Chrome is patched
Instruct users to avoid interacting with untrusted pages that request unusual gestures or overlays
Enforce corporate browser policies that block navigation to uncategorized or newly registered domains

bash

# Verify installed Chrome for iOS version via MDM query (example)
# Compliance target: 151.0.7922.72 or later
mdm query --app com.google.chrome.ios --field CFBundleShortVersionString