CVE-2026-17845 Overview
CVE-2026-17845 is a Universal Cross-Site Scripting (UXSS) vulnerability in Google Chrome caused by an inappropriate implementation in the browser's CSS engine. Versions of Chrome prior to 151.0.7922.72 allow a remote attacker to inject arbitrary scripts or HTML through a crafted HTML page. Google classifies the Chromium security severity as Medium.
The flaw undermines the same-origin policy, permitting script execution in the context of arbitrary web origins. Successful exploitation enables session theft, credential harvesting, and unauthorized actions on behalf of the victim.
Critical Impact
A UXSS condition in the CSS engine allows remote attackers to execute arbitrary scripts across origins by luring users to a crafted HTML page.
Affected Products
- Google Chrome Desktop versions prior to 151.0.7922.72
- Chromium-based browsers sharing the affected CSS implementation
- All operating systems supported by Chrome Stable (Windows, macOS, Linux)
Discovery Timeline
- 2026-07-30 - CVE-2026-17845 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17845
Vulnerability Analysis
The vulnerability resides in Chrome's CSS implementation and results in a Universal Cross-Site Scripting condition. Unlike traditional XSS, UXSS exploits a browser bug rather than a web application flaw. The browser itself becomes the injection vector, letting attacker-controlled script execute in the security context of a targeted origin.
An attacker delivers a crafted HTML page containing malicious CSS constructs. When Chrome processes the page, the CSS engine mishandles specific inputs and permits HTML or JavaScript to enter a document context where it should not be permitted. This breaks the same-origin policy enforced by the browser.
Because the flaw operates below the level of individual web applications, no server-side vulnerability is required in the targeted site. Any origin loaded through the affected code path can become a UXSS target.
Root Cause
The root cause is an inappropriate implementation within the CSS handling code in Blink, Chrome's rendering engine. The engine fails to enforce required boundary or origin checks when processing crafted CSS content. Technical details are tracked in the Chromium Issue Tracker Report.
Attack Vector
Exploitation requires a user to visit an attacker-controlled or compromised web page in a vulnerable Chrome build. The attacker hosts a page that includes crafted HTML and CSS payloads designed to trigger the flaw. On render, the malicious script executes with the privileges of a targeted origin, enabling data exfiltration, session hijacking, or further client-side attacks. See the Google Chrome Desktop Update advisory for release information.
Detection Methods for CVE-2026-17845
Indicators of Compromise
- Chrome browser processes rendering pages from untrusted domains while running versions prior to 151.0.7922.72.
- Outbound network requests from browser sessions to unfamiliar domains hosting HTML files with unusual CSS payloads.
- Unexpected authentication token or cookie exfiltration events originating from browser processes.
Detection Strategies
- Inventory Chrome installations across the fleet and flag any endpoint running a build below 151.0.7922.72.
- Monitor proxy and DNS logs for user navigation to newly registered or low-reputation domains delivering HTML content.
- Correlate browser telemetry with identity events to detect anomalous session activity that may follow a UXSS payload.
Monitoring Recommendations
- Enable browser version reporting through enterprise management (Chrome Browser Cloud Management or equivalent MDM).
- Alert on Chrome child processes performing unexpected file writes or spawning unusual child processes after web navigation.
- Retain web proxy logs for retrospective hunting once additional indicators are published by Google.
How to Mitigate CVE-2026-17845
Immediate Actions Required
- Update Google Chrome Desktop to version 151.0.7922.72 or later on all endpoints.
- Force-restart Chrome after deployment to ensure the patched binary is loaded.
- Prioritize patching for users with access to sensitive web applications, administrative consoles, and identity providers.
Patch Information
Google addressed the vulnerability in Chrome Stable Channel version 151.0.7922.72. Deployment details are documented in the Google Chrome Desktop Update release notes. Chromium-based browsers should apply the corresponding upstream fix once available.
Workarounds
- Restrict browsing to trusted sites through enterprise policy until patching is complete.
- Deploy content security policies and HttpOnly cookie flags on internal applications to reduce impact of client-side script execution.
- Consider temporarily using an alternative browser for high-value administrative tasks on unpatched endpoints.
# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version
# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info.plist CFBundleShortVersionString
# Verify installed Chrome version on Linux endpoints
google-chrome --version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
