CVE-2026-17904: Google Chrome NFC Information Disclosure

CVE-2026-17904 Overview

CVE-2026-17904 is an insufficient policy enforcement vulnerability in the Near Field Communication (NFC) component of Google Chrome on Android. Versions prior to 151.0.7922.72 are affected. A remote attacker can leak cross-origin data by serving a crafted HTML page to a targeted user. The Chromium project rated the security severity as Low. Exploitation requires user interaction with attacker-controlled web content on an Android device. No public proof-of-concept, exploit code, or evidence of exploitation in the wild is reported at this time.

Critical Impact
Successful exploitation allows a remote attacker to bypass same-origin policy enforcement in the NFC subsystem and leak cross-origin data through a crafted HTML page.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based Android browsers sharing the affected NFC implementation
Android WebView instances built on affected Chromium versions

Discovery Timeline

2026-07-30 - CVE-2026-17904 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17904

Vulnerability Analysis

The vulnerability resides in the NFC implementation in Chrome for Android. Chrome exposes NFC through the Web NFC API, which is gated by origin, permission, and top-level frame policy checks. Insufficient enforcement of these policies allows content from one origin to observe or access data associated with another origin. The result is a cross-origin information leak triggered by a crafted HTML page.

Because the flaw is scoped to the Android build of Chrome and to the NFC subsystem, exposure is limited to mobile users on Android devices that browse attacker-controlled or attacker-influenced web pages. The Chromium project classified the security severity as Low, consistent with a scoped information disclosure rather than code execution or full sandbox escape.

Root Cause

The root cause is inadequate policy enforcement in the Web NFC code path. Origin and permission checks that should isolate NFC-related data between origins were not applied correctly on all reachable paths, permitting cross-origin observation of data that same-origin policy is intended to protect. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for upstream details.

Attack Vector

An attacker hosts a crafted HTML page and lures an Android Chrome user to visit it. The page exercises the flawed NFC code path to read cross-origin data that should be inaccessible to the attacker origin. The attack is remote and requires user interaction limited to loading the malicious page in a vulnerable Chrome build. No verified public exploit code is available; describe and reproduce only in a controlled test environment against the affected version.

Detection Methods for CVE-2026-17904

Indicators of Compromise

Android Chrome clients reporting a User-Agent version lower than 151.0.7922.72 in web proxy or CDN logs
Outbound requests from Android devices to unfamiliar domains immediately followed by uploads of structured data to attacker-controlled endpoints
Web pages exercising the Web NFC API from low-reputation or newly registered domains

Detection Strategies

Inventory installed Chrome versions on managed Android endpoints using mobile device management telemetry and flag builds below 151.0.7922.72.
Inspect web gateway logs for HTML content that invokes Web NFC interfaces from origins outside an approved allowlist.
Correlate browser version data with browsing history to identify users who visited untrusted origins while on a vulnerable build.

Monitoring Recommendations

Enable Chrome enterprise reporting to receive version and update status for every managed Android device.
Monitor for lateral indicators such as unexpected exfiltration of session tokens, cookies, or account identifiers that could result from a cross-origin leak.
Subscribe to the Chrome Releases feed and Chromium issue tracker to receive upstream advisories tied to NFC and Web NFC components.

How to Mitigate CVE-2026-17904

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store on every managed device.
Enforce a minimum Chrome version policy in mobile device management to block execution of vulnerable builds.
Restrict use of the Web NFC API to trusted origins through enterprise browser policy where the deployment supports it.

Patch Information

Google addressed CVE-2026-17904 in Chrome for Android 151.0.7922.72. Deployment details are documented in the Google Chrome Update Announcement, and the underlying issue is tracked in the Chromium Issue Tracker Entry. Users receive the update automatically through Google Play; managed fleets should verify rollout completion.

Workarounds

Disable NFC on Android devices that do not require it, removing the local capability the browser depends on.
Use enterprise browser policy to block or restrict the Web NFC permission until patched builds are deployed.
Instruct users to avoid untrusted links on Android and to close Chrome tabs from unknown origins until update verification completes.

bash

# Configuration example: enforce minimum Chrome version via Android enterprise policy
# Managed configuration key applied through MDM to com.android.chrome
{
  "MinimumChromeVersion": "151.0.7922.72",
  "DefaultWebNfcSetting": 2,
  "WebNfcAllowedForUrls": ["https://intranet.example.com"]
}