CVE-2026-17895: Google Chrome Information Disclosure Flaw

CVE-2026-17895 Overview

CVE-2026-17895 is an inappropriate implementation vulnerability in the DataTransfer component of Google Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by convincing a user to perform specific user interface (UI) gestures on a crafted HTML page. Chromium classifies the security severity as Medium. The issue affects the browser's handling of clipboard and drag-and-drop data exchanged between origins, which should be strictly isolated under the same-origin policy.

Critical Impact
Cross-origin data leakage through the DataTransfer interface enables attackers to obtain sensitive content from other origins when victims perform attacker-guided UI interactions.

Affected Products

Google Chrome for Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected DataTransfer implementation
Downstream Chromium forks that had not yet integrated the upstream fix

Discovery Timeline

2026-07-30 - CVE-2026-17895 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17895

Vulnerability Analysis

The vulnerability resides in Chrome's implementation of the DataTransfer object, which mediates data exchange during clipboard operations and drag-and-drop events. Under the same-origin policy, content associated with these operations must remain isolated from cross-origin scripts. The flawed implementation permits an attacker-controlled page to observe or read data belonging to another origin when the user performs specific gestures. These gestures typically include drag-and-drop, paste, or selection actions initiated on a crafted page.

Because exploitation requires user interaction, the attack relies on social engineering. Attackers can disguise malicious drop targets as benign UI elements such as file upload zones, game controls, or CAPTCHA prompts. The Chromium project categorizes this issue as Medium severity, reflecting the required user interaction and the scoped nature of the disclosed data.

Root Cause

The root cause is an inappropriate implementation in the DataTransfer code path that fails to enforce origin boundaries on data made accessible through UI-driven events. See the Chromium Issue Tracker #524931675 for the upstream discussion and fix reference.

Attack Vector

The attacker hosts a crafted HTML page and lures the victim into visiting it. The page instruments dragstart, drop, paste, or similar handlers to capture cross-origin data surfaced through DataTransfer. When the victim performs the required gesture, the malicious script exfiltrates the leaked content to an attacker-controlled endpoint. No verified public exploit code is available; refer to the Google Chrome Stable Update advisory for vendor details.

Detection Methods for CVE-2026-17895

Indicators of Compromise

Chrome desktop clients running versions earlier than 151.0.7922.72 in the environment inventory
Web pages that register unusual dragstart, drop, or paste event listeners tied to hidden iframes or overlays
Outbound HTTP requests carrying base64 or URL-encoded payloads immediately following user drag-and-drop or paste events

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.72
Inspect browser telemetry and web proxy logs for pages that combine cross-origin iframes with drag-and-drop event handlers
Correlate user interaction events with subsequent outbound network flows to identify suspicious data staging

Monitoring Recommendations

Enable browser version reporting through enterprise management channels to track patch adoption
Forward web proxy and DNS telemetry into a SIEM for hunting on newly registered domains that host interactive lures
Alert on Chrome processes reaching low-reputation domains shortly after clipboard or drag events recorded by endpoint agents

How to Mitigate CVE-2026-17895

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop endpoints
Push the update through enterprise management tooling and verify compliance across managed fleets
Restart browser sessions after the update to ensure the patched binary is loaded

Patch Information

Google addressed CVE-2026-17895 in the Chrome Stable channel update to 151.0.7922.72. Details are available in the Google Chrome Stable Update announcement. Chromium-based browser vendors should integrate the upstream fix referenced in Chromium Issue #524931675.

Workarounds

Advise users to avoid performing drag-and-drop or paste actions on untrusted web pages until the patch is applied
Restrict browsing to trusted domains via enterprise web filtering while remediation is in progress
Disable automatic clipboard sharing between origins using enterprise browser policies where available

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux endpoints
google-chrome --version