CVE-2026-17873: Chrome for iOS Auth Bypass Vulnerability

CVE-2026-17873 Overview

CVE-2026-17873 is a policy enforcement flaw in Google Chrome for iOS versions prior to 151.0.7922.72. A remote attacker can bypass discretionary access control by delivering a crafted HTML page to a targeted user. Google's Chromium security team rated the issue at Medium severity.

The vulnerability lives in the iOS-specific Chrome build and requires no privileges to exploit. User interaction — loading the malicious page — is the only precondition. Successful exploitation lets attackers circumvent browser-level access restrictions that normally isolate web content.

Critical Impact
A crafted HTML page can bypass discretionary access controls in Chrome for iOS, undermining browser isolation boundaries relied on to protect user data and cross-origin content.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running affected Chrome builds
Users browsing untrusted web content in vulnerable Chrome for iOS versions

Discovery Timeline

2026-07-30 - CVE-2026-17873 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17873

Vulnerability Analysis

CVE-2026-17873 is an insufficient policy enforcement issue in Chrome for iOS. Policy enforcement flaws occur when the browser fails to consistently apply security decisions such as same-origin restrictions, permission checks, or download and navigation constraints. In this case, the enforcement gap allows a crafted HTML page to bypass discretionary access control.

Discretionary access control in a browser context governs which resources a page can reach based on user or site permissions. When enforcement is incomplete, an attacker-controlled page can reach content, invoke capabilities, or trigger actions that policy should have blocked.

Because Chrome for iOS must use Apple's WKWebView engine under App Store rules, iOS-specific policy paths differ from desktop Chrome. Advisories for this class of issue often trace back to iOS-specific handling of URL schemes, download flows, or inter-app navigation.

Root Cause

The root cause is incomplete policy enforcement in Chrome for iOS logic that mediates access to restricted resources. Google did not publish detailed technical internals in the public advisory. Additional context is available in the Chromium Issue Tracker entry.

Attack Vector

Exploitation is remote. An attacker hosts a crafted HTML page and lures a user of a vulnerable Chrome for iOS build to visit it. The page issues requests or navigations shaped to slip past the deficient policy check. No authentication is required, and the interaction fits standard drive-by browsing scenarios such as malicious ads, phishing links, or compromised sites.

No public proof-of-concept exploit is listed for this CVE. See the Google Chrome Stable Update advisory for release context.

Detection Methods for CVE-2026-17873

Indicators of Compromise

Chrome for iOS clients reporting versions earlier than 151.0.7922.72 in mobile device management (MDM) inventory
Mobile browser navigations to unclassified or newly registered domains delivering HTML content that triggers unexpected resource access
User reports of Chrome for iOS performing actions or accessing content without an expected prompt

Detection Strategies

Query MDM and endpoint inventory for Chrome for iOS versions and flag any build below 151.0.7922.72.
Correlate mobile web proxy logs with threat intelligence feeds to surface iOS Chrome user agents visiting known malicious pages.
Review any custom URL scheme handling or deep-link telemetry originating from Chrome for iOS for anomalous cross-app invocations.

Monitoring Recommendations

Track Chrome for iOS version distribution weekly until fleet-wide upgrade to 151.0.7922.72 or later is confirmed.
Alert on repeated visits from mobile Safari/Chrome iOS user agents to domains newly flagged for browser exploit delivery.
Monitor Apple App Store update compliance rates for managed iOS devices to detect stalled Chrome updates.

How to Mitigate CVE-2026-17873

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store.
Enforce automatic app updates for managed iOS fleets via MDM configuration.
Notify users to close and relaunch Chrome after updating to ensure the patched build is active.

Patch Information

Google addressed CVE-2026-17873 in Chrome for iOS 151.0.7922.72. Users and administrators should install this or a later release from the App Store. Reference the Google Chrome Stable Update advisory for release details.

Workarounds

Restrict browsing to trusted sites until the Chrome for iOS update is applied.
Use an alternative browser on iOS temporarily where feasible for sensitive workflows.
Apply MDM web content filtering to block unclassified or high-risk domains for iOS devices pending patch deployment.

bash

# Verify Chrome for iOS version via MDM query (example: Jamf Pro)
# Target application bundle: com.google.chrome.ios
# Required version: 151.0.7922.72 or later
jamf policy -event inventory-update
# Then review Mobile Device Inventory > Applications for com.google.chrome.ios