CVE-2026-17846: Google Chrome Same Origin Policy Bypass

CVE-2026-17846 Overview

CVE-2026-17846 is an inappropriate implementation vulnerability in the Media component of Google Chrome on Windows. The flaw affects versions prior to 151.0.7922.72. A remote attacker who had already compromised the renderer process could bypass the same-origin policy through a crafted HTML page. Google classifies the Chromium security severity as Medium.

The issue was addressed in the Stable channel desktop update for Chrome 151. Successful exploitation allows cross-origin data access from within a subverted renderer, weakening the browser's sandboxed origin isolation guarantees.

Critical Impact
An attacker with control of the renderer process can read or manipulate resources from origins other than the one served to the user, breaking a core web security boundary.

Affected Products

Google Chrome for Windows versions prior to 151.0.7922.72
Chromium-based browsers that inherit the vulnerable Media component code before the corresponding upstream fix
Windows desktop deployments distributing Chrome through the Stable channel prior to the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17846 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17846

Vulnerability Analysis

CVE-2026-17846 is categorized as an Authorization Bypass affecting the same-origin policy (SOP) enforcement in Chrome's Media stack. The Media component handles decoding, playback, and resource loading for audio and video content. Improper implementation in this pipeline permits cross-origin resource access when the renderer is already under attacker control.

The same-origin policy is a fundamental browser security boundary. It restricts scripts and content loaded from one origin from reading data belonging to another. When Media component code fails to enforce origin checks correctly, a compromised renderer can request and observe content that should be inaccessible.

Exploitation is described as requiring a prior renderer compromise, which typically comes from chaining this issue with a separate memory-safety or logic bug. Once chained, an attacker can pivot from arbitrary read-write inside the renderer sandbox to reading cross-origin data such as authenticated media resources, session-linked responses, or private third-party content.

Root Cause

The root cause is an inappropriate implementation in how the Media subsystem validates or applies origin restrictions when loading or processing media resources. The check that should confine renderer requests to same-origin data does not hold under the specific request sequence produced by a crafted HTML page. Refer to Chromium Issue #518121320 for the tracker entry.

Attack Vector

The attack requires two conditions. First, the attacker must already have compromised the renderer process, typically through a separate exploit. Second, the attacker delivers a crafted HTML page that triggers the vulnerable media code path. The result is a bypass of same-origin policy, giving the attacker read access to cross-origin content that would otherwise be isolated by the browser.

No verified proof-of-concept code has been published. See the Google Chrome Desktop Update advisory for the vendor summary.

Detection Methods for CVE-2026-17846

Indicators of Compromise

Chrome processes on Windows running versions earlier than 151.0.7922.72 after the vendor patch date
Unexpected child renderer processes performing outbound requests to origins unrelated to the active browsing session
HTML files hosted on untrusted sites that reference unusual <video> or <audio> sources targeting cross-origin authenticated endpoints

Detection Strategies

Inventory installed Chrome builds across Windows endpoints and flag any host below 151.0.7922.72
Correlate browser process telemetry with network events showing cross-origin media fetches to sensitive internal domains
Monitor endpoint EDR for renderer processes exhibiting behavior consistent with prior sandboxed exploitation, such as unusual IPC patterns preceding the media request

Monitoring Recommendations

Ingest Chrome update and version telemetry into the SIEM to track patch compliance over time
Alert on browser child processes generating outbound requests to authentication-bearing endpoints from untrusted parent tabs
Track user reports of unexpected media playback prompts or session activity on internal web applications accessed via Chrome

How to Mitigate CVE-2026-17846

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 151.0.7922.72 or later
Force a browser restart after deployment so the patched binary is loaded into memory
Verify Chrome auto-update policy is enabled in managed environments using Chrome Enterprise or group policy

Patch Information

Google released the fix in the Stable channel update for desktop, bringing Chrome to version 151.0.7922.72 on Windows. Full details are available in the Google Chrome Desktop Update release announcement. Chromium-based browsers should pull the corresponding upstream fix; check individual vendor advisories for their patched versions.

Workarounds

No official workaround exists; apply the vendor patch as the primary remediation
Restrict browsing to trusted sites through URL filtering until patch deployment completes, reducing exposure to crafted HTML pages
Enforce Chrome site isolation and strict origin policies via enterprise policy to raise the difficulty of chaining a renderer compromise

bash

# Verify installed Chrome version on Windows endpoints via PowerShell
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Force Chrome update check through the management channel
reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 60 /f