CVE-2026-17900 Overview
CVE-2026-17900 is an inappropriate implementation flaw in the Enterprise component of Google Chrome on Windows. Versions of Chrome prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by delivering a malicious file to a targeted user. The Chromium project rated the security severity as Low.
The issue enables violation of the same-origin policy, allowing an attacker to obtain data that should remain isolated between web origins. Exploitation requires the victim to interact with attacker-controlled content, which reduces the practical impact but does not eliminate risk in targeted scenarios.
Critical Impact
A remote attacker can leak cross-origin data from Chrome on Windows by delivering a malicious file to a user running a vulnerable release.
Affected Products
- Google Chrome for Windows prior to 151.0.7922.72
- Chromium-based Enterprise deployments on Windows using vulnerable Chrome builds
- Managed Windows endpoints that have not received the Stable channel update
Discovery Timeline
- 2026-07-30 - CVE-2026-17900 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17900
Vulnerability Analysis
The vulnerability resides in the Enterprise component of Google Chrome on Windows. The advisory describes it as an inappropriate implementation, meaning the code enforces browser security boundaries in a way that deviates from the intended design. Attackers exploit the flaw to bypass cross-origin restrictions and read data belonging to a different origin.
The browser normally isolates content from different origins through the same-origin policy. When this policy is enforced incorrectly, script or resource handling logic may expose information such as response contents, DOM state, or file metadata across origin boundaries. Google has not publicly detailed the affected code path. See the Chromium Issue Tracker Entry once access restrictions lift, and the Google Chrome Desktop Update announcement for release context.
Root Cause
The root cause is an implementation defect in Enterprise-related handling within Chrome on Windows. The code fails to correctly apply cross-origin protections when processing a specific class of files. This allows content from one origin to observe or receive data associated with another origin during file handling.
Attack Vector
An attacker hosts or delivers a malicious file to the victim. The victim opens or triggers processing of that file in a vulnerable Chrome build on Windows. Chrome then leaks cross-origin data to a context controlled by the attacker. The attack is remote and file-based, and requires user interaction to open the crafted resource.
No verified exploit code is publicly available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Chromium Issue Tracker Entry for further technical detail as Google publishes it.
Detection Methods for CVE-2026-17900
Indicators of Compromise
- Chrome browser instances on Windows reporting a version below 151.0.7922.72 in inventory or user-agent telemetry.
- Unexpected downloads or opens of files delivered from untrusted or newly registered domains, followed by outbound requests to attacker-controlled hosts.
- Browser process activity that reads or transmits content associated with authenticated web sessions to unrelated origins.
Detection Strategies
- Query endpoint inventory for installed Chrome versions on Windows and flag any build older than 151.0.7922.72.
- Correlate browser file-open events with subsequent network egress to newly observed external domains within short time windows.
- Monitor enterprise policy channels and Chrome update telemetry for hosts that are failing to apply Stable channel updates.
Monitoring Recommendations
- Enable Chrome Enterprise reporting to centralize version, extension, and policy state across managed Windows fleets.
- Alert on user-initiated downloads of file types associated with cross-origin content loading, particularly from external senders.
- Track outbound HTTP requests from chrome.exe that reference sensitive internal origins after a document is opened.
How to Mitigate CVE-2026-17900
Immediate Actions Required
- Update Google Chrome on all Windows endpoints to 151.0.7922.72 or later using the Stable channel.
- Force a browser restart after the update completes so the patched binary loads for all active user sessions.
- Validate deployment status through Chrome Enterprise reporting or endpoint management tooling.
Patch Information
Google addressed the issue in Chrome 151.0.7922.72 for Windows, released through the Stable channel. See the Google Chrome Desktop Update for the full release notes and channel details.
Workarounds
- Restrict the ability to open untrusted files in Chrome by enforcing SmartScreen and download restrictions through Chrome Enterprise policy.
- Advise users to avoid opening files from untrusted email attachments or unfamiliar websites until patching is complete.
- Where feasible, isolate high-value browsing sessions from general web browsing on separate profiles or endpoints.
# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
# Force Chrome update via Google Update on managed endpoints
"C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /ua /installsource scheduler
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
