CVE-2026-17859: Google Chrome Favicon Data Leak Flaw

CVE-2026-17859 Overview

CVE-2026-17859 is an inappropriate implementation vulnerability in the Favicons component of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. Google's Chromium security team rated the severity as Medium.

The flaw undermines the same-origin policy by exposing information from other origins through favicon handling. Successful exploitation requires the victim to visit an attacker-controlled page. The issue is tracked as [CWE-1300] and is addressed in the Chrome Stable channel release announced by Google.

Critical Impact
Remote attackers can leak cross-origin data from a victim's browser session by serving a crafted HTML page, weakening browser isolation between web origins.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Favicons implementation
All supported desktop platforms (Windows, macOS, Linux) running affected Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17859 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17859

Vulnerability Analysis

The vulnerability resides in Chrome's Favicons subsystem, which retrieves and caches site icons referenced by HTML documents. An inappropriate implementation allows a crafted page to observe or infer data associated with cross-origin resources. This effectively bypasses the browser's origin isolation guarantees for the affected code path.

Because favicons are typically fetched with implicit credentials and are subject to browser-level caching, weaknesses in this pipeline can be leveraged as a side channel. An attacker page can trigger favicon loads that reveal information about the user's authenticated state, cached resources, or content on other origins. The disclosure vector is passive from the victim's perspective, requiring only that they load the malicious page.

Root Cause

The root cause is classified under [CWE-1300], indicating improper protection of physical or logical side channels. In this case, Favicons handling does not adequately enforce origin boundaries or normalize observable side effects. Details are tracked in Chromium Issue Tracker #520196753.

Attack Vector

Exploitation is network-based and requires user interaction limited to visiting an attacker-controlled web page. The crafted HTML embeds specific favicon references or DOM structures that induce the browser to leak cross-origin state. No authentication is required, and the attack executes entirely within the rendering context of a modern web page.

No verified proof-of-concept code has been published. Technical details are described in the Google Chrome Stable Channel Update and the associated Chromium issue.

Detection Methods for CVE-2026-17859

Indicators of Compromise

Chrome browser processes running versions prior to 151.0.7922.72 in enterprise inventory
Outbound requests to unfamiliar domains hosting HTML pages with unusually high volumes of favicon or <link rel="icon"> references
Web proxy logs showing repeated favicon fetches to third-party origins immediately after page loads

Detection Strategies

Inventory Chrome versions across managed endpoints and flag hosts running builds below 151.0.7922.72
Monitor browser telemetry and proxy logs for anomalous cross-origin favicon request patterns tied to a single referring page
Correlate suspicious page visits with subsequent authentication or session anomalies on internal web applications

Monitoring Recommendations

Ingest browser version data into asset management and vulnerability tooling to track patch compliance
Alert on user visits to newly registered or low-reputation domains that serve HTML with heavy favicon usage
Retain web proxy and DNS logs long enough to reconstruct favicon request chains associated with suspected data exposure

How to Mitigate CVE-2026-17859

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force restart of Chrome processes to ensure the patched binary is loaded into memory
Verify Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google addressed the vulnerability in Chrome Stable channel 151.0.7922.72 for desktop platforms. Administrators should deploy the update through Chrome Enterprise policies, MDM, or software distribution tools. Details are available in the Google Chrome Stable Channel Update.

Workarounds

Restrict browsing to trusted sites via enterprise web filtering until the patch is deployed
Disable or restrict favicon fetching through browser policies where supported
Enforce strict site isolation and third-party cookie blocking to reduce cross-origin exposure

bash

# Verify installed Chrome version on Windows, macOS, and Linux
# Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 151.0.7922.72 or later