CVE-2026-17897: Google Chrome ORB Information Disclosure

CVE-2026-17897 Overview

CVE-2026-17897 is an inappropriate implementation vulnerability in Opaque Response Blocking (ORB) affecting Google Chrome versions prior to 151.0.7922.72. The flaw allows a remote attacker to leak cross-origin data through a crafted HTML page. Chromium developers assigned this issue a Medium security severity rating. The vulnerability undermines the same-origin protections that ORB is designed to enforce for cross-origin subresource responses.

Attackers can weaponize this issue by hosting a malicious webpage that entices a victim to visit it. Successful exploitation leaks sensitive data from other origins the user has authenticated to, breaking the browser's security boundary.

Critical Impact
Remote attackers can exfiltrate cross-origin data from authenticated user sessions through a crafted HTML page, bypassing ORB protections in Chrome.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable ORB implementation
All operating system builds of Chrome Stable channel below the patched version

Discovery Timeline

2026-07-30 - CVE-2026-17897 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17897

Vulnerability Analysis

The vulnerability resides in Chrome's Opaque Response Blocking (ORB) component. ORB is a browser security mechanism that prevents cross-origin subresources such as HTML, JSON, and XML from being delivered to contexts that should not be able to read them. When ORB is implemented incorrectly, protected content can reach an attacker-controlled context, resulting in cross-origin information disclosure.

In this case, an inappropriate implementation permits a remote attacker to construct HTML that manipulates how the browser evaluates or filters cross-origin responses. The resulting behavior leaks data that ORB should have blocked. The issue is classified as an information disclosure flaw affecting the confidentiality of cross-origin resources.

Root Cause

The root cause is an incorrect enforcement path within the ORB logic in Chrome versions below 151.0.7922.72. The implementation fails to fully block responses that should be treated as opaque to the requesting origin. This gap allows an attacker page to observe or infer content from a foreign origin.

Attack Vector

Exploitation requires a remote attacker to lure a victim into loading a crafted HTML page in a vulnerable Chrome build. No local access or elevated privileges are needed. Once loaded, the page issues requests designed to exploit the ORB weakness and extract data from other origins the victim is authenticated to. Detailed technical specifics are tracked in the Chromium Issue Tracker Entry and the Google Chrome Update Blog.

// No verified proof-of-concept code is available for this issue.
// See the Chromium Issue Tracker for authoritative technical details.

Detection Methods for CVE-2026-17897

Indicators of Compromise

Chrome browser instances reporting versions below 151.0.7922.72 in endpoint inventory
Outbound requests from browsers to newly registered or low-reputation domains hosting crafted HTML content
Unexpected cross-origin subresource requests originating from user sessions to sensitive internal applications

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build older than 151.0.7922.72.
Correlate web proxy logs with threat intelligence feeds to identify visits to pages known to abuse ORB.
Monitor for anomalous cross-origin fetch patterns preceding data exfiltration attempts.

Monitoring Recommendations

Enable browser telemetry collection to centralize version and extension state data.
Ingest proxy, DNS, and endpoint logs into a unified data platform for correlation across user browsing sessions.
Alert on repeated cross-origin request failures or unusual response sizes to authenticated internal origins.

How to Mitigate CVE-2026-17897

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Force-restart Chrome after deployment so the patched binary is loaded into active sessions.
Audit Chromium-based third-party browsers for equivalent updates addressing the ORB flaw.

Patch Information

Google released the fix in Chrome Stable 151.0.7922.72. Refer to the Google Chrome Update Blog for the official release notes and the Chromium Issue Tracker Entry for issue tracking.

Workarounds

Restrict browsing to trusted sites through enterprise web filtering until patches are deployed.
Enforce Chrome auto-update policies via group policy or MDM to ensure timely delivery of security fixes.
Reduce cross-origin exposure by requiring strict Cross-Origin-Resource-Policy and Cross-Origin-Opener-Policy headers on sensitive internal applications.

bash

# Example: verify installed Chrome version on Linux endpoints
google-chrome --version

# Example: enforce auto-update on macOS via defaults
defaults write com.google.Keystone.Agent checkInterval 3600