CVE-2026-17843 Overview
CVE-2026-17843 is a cross-origin data disclosure vulnerability affecting Google Chrome versions prior to 151.0.7922.72. The flaw stems from an inappropriate implementation in the browser's Cascading Style Sheets (CSS) engine. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. Chromium's security team rated the issue Medium severity. The vulnerability enables violation of the same-origin policy through CSS-based side effects, potentially exposing content from other web origins the victim is authenticated to.
Critical Impact
Remote attackers can bypass the same-origin policy through crafted HTML and CSS, leaking sensitive cross-origin data such as authenticated user content from third-party sites.
Affected Products
- Google Chrome desktop versions prior to 151.0.7922.72
- Chromium-based browsers incorporating the vulnerable CSS implementation
- Downstream browsers (Edge, Brave, Opera, Vivaldi) pending vendor updates
Discovery Timeline
- 2026-07-30 - CVE-2026-17843 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17843
Vulnerability Analysis
The vulnerability resides in Chrome's CSS implementation and permits cross-origin information disclosure. Browsers enforce the same-origin policy to prevent one origin from reading data belonging to another. When CSS features are implemented without strict origin checks, side effects such as layout timing, rendering behavior, or computed style access can leak data across origins. An attacker hosts a malicious HTML page that embeds or references cross-origin content and applies crafted CSS to observe measurable side effects that reveal characteristics of that content.
This class of issue is categorized as Information Exposure and typically falls under [CWE-200]. Because the attack requires only that a victim visit an attacker-controlled page, exploitation scales easily through malvertising, phishing links, or compromised web properties.
Root Cause
The root cause is an inappropriate implementation within Chrome's CSS pipeline that fails to isolate cross-origin resources from observable side channels. Details for the underlying bug are tracked in Chromium Issue Tracker #518103887 but remain restricted at the time of publication.
Attack Vector
An attacker delivers a crafted HTML page containing CSS constructs that reference or interact with cross-origin resources. When the victim's browser renders the page, observable rendering behavior enables the attacker to infer content that should be inaccessible per the same-origin policy. No authentication or user interaction beyond visiting the page is required.
No public proof-of-concept code is available. Refer to the Google Chrome Stable Channel Update for vendor detail.
Detection Methods for CVE-2026-17843
Indicators of Compromise
- Outbound browser requests to unfamiliar domains immediately following visits to untrusted sites
- Chrome client versions reporting builds earlier than 151.0.7922.72 in inventory data
- Web proxy logs showing HTML responses containing anomalous CSS referencing cross-origin resources
Detection Strategies
- Inventory browser versions across managed endpoints and flag Chrome installations below 151.0.7922.72
- Monitor DNS and proxy telemetry for connections to newly registered domains delivering HTML with heavy cross-origin CSS references
- Correlate browser process telemetry with visits to low-reputation URLs from threat intelligence feeds
Monitoring Recommendations
- Continuously collect installed browser version data from endpoint agents and alert on out-of-date Chrome builds
- Ingest web proxy and DNS logs into a centralized data lake for cross-source correlation
- Track patch compliance metrics against the fixed version 151.0.7922.72
How to Mitigate CVE-2026-17843
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
- Force-restart Chrome on user endpoints to ensure the patched binary is loaded into memory
- Audit Chromium-based browsers in the environment and apply vendor updates as they become available
Patch Information
Google released the fix in the Chrome Stable channel. Administrators should deploy Chrome 151.0.7922.72 or later. Full release notes are published in the Google Chrome Stable Channel Update.
Workarounds
- Restrict browsing to trusted sites through web filtering policies until patches are deployed
- Enable Chrome enterprise policies that enforce automatic updates and prohibit version rollback
- Advise users to avoid clicking links in unsolicited email or messaging until browsers are updated
# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString
# Verify installed Chrome version on Linux
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
