CVE-2026-17910: Chrome Android NFC Data Leak Vulnerability

CVE-2026-17910 Overview

CVE-2026-17910 is an insufficient policy enforcement vulnerability in the Near Field Communication (NFC) component of Google Chrome on Android. Versions prior to 151.0.7922.72 fail to properly enforce origin-based policy controls on NFC operations. A remote attacker can craft an HTML page that leaks cross-origin data when rendered by an affected browser. Chromium security engineers rated the underlying issue as Low severity. The flaw affects only the Android build of Chrome, since Chrome NFC support is limited to that platform.

Critical Impact
A crafted web page can bypass same-origin restrictions on NFC data, exposing cross-origin content to an attacker-controlled site.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium-based Android browsers inheriting the same NFC implementation
Android WebView components tracking the vulnerable Chromium branch

Discovery Timeline

2026-07-30 - CVE-2026-17910 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17910

Vulnerability Analysis

The vulnerability resides in Chrome's Web NFC implementation on Android. Web NFC exposes JavaScript APIs that allow web pages to read and write NFC tags. Access to these APIs is gated by permission prompts and same-origin policy enforcement. In affected builds, policy checks are not consistently applied to NFC-mediated data flows. This gap allows a page under one origin to observe data belonging to a different origin. The result is a cross-origin information disclosure primitive that operates through the NFC subsystem rather than through the standard DOM or fetch pipelines. Chromium engineers assessed the security impact as Low, reflecting narrow preconditions such as user interaction with NFC hardware.

Root Cause

The root cause is insufficient policy enforcement on NFC operations invoked from web content. The browser accepts NFC-related actions without fully validating the invoking origin against the origin associated with cached or in-flight NFC data. This is a class of access control weakness aligned with improper enforcement of origin isolation in web platform APIs.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome on Android build. The page invokes Web NFC APIs to trigger the flawed policy path and reads data that should be restricted to another origin. No authentication is required on the attacker side. The attacker must convince the user to visit the malicious page and, depending on the API surface, to interact with an NFC tag. No verified proof-of-concept code has been published. Refer to the Chromium Issue Tracker #501749600 once access restrictions are lifted for reproduction details.

Detection Methods for CVE-2026-17910

Indicators of Compromise

Android devices running Chrome versions below 151.0.7922.72 observed browsing untrusted content
Web pages invoking NDEFReader or related Web NFC APIs from low-reputation origins
Unexpected NFC read prompts on managed Android endpoints

Detection Strategies

Inventory Chrome for Android versions across mobile fleets and flag installations below 151.0.7922.72
Inspect mobile browsing telemetry for pages requesting NFC permissions from untrusted origins
Correlate NFC permission grants with subsequent outbound requests to attacker-controlled infrastructure

Monitoring Recommendations

Enable mobile threat defense telemetry on corporate Android devices to record Chrome version and permission events
Monitor Mobile Device Management (MDM) compliance reports for out-of-date Chrome installations
Log DNS and proxy events from Android endpoints for indicators of malicious HTML delivery vectors

How to Mitigate CVE-2026-17910

Immediate Actions Required

Update Chrome on Android to version 151.0.7922.72 or later through the Google Play Store
Enforce minimum Chrome version compliance policies through your MDM solution
Restrict NFC permission grants in browsers on managed devices where NFC is not required

Patch Information

Google addressed the issue in the Chrome stable channel update referenced in the Google Chrome release announcement. Users should install Chrome 151.0.7922.72 or later on Android. Chromium-derived browsers should incorporate the same upstream fix tracked in Chromium Issue #501749600.

Workarounds

Disable NFC on Android devices where the capability is not required for business function
Deny Web NFC permission prompts on untrusted sites and revoke previously granted permissions
Use browser management policies to block Web NFC via enterprise configuration until patched Chrome versions are deployed

bash

# Example Android Enterprise managed configuration for Chrome
# Force minimum version and disable Web NFC via policy
adb shell am start-activity \
  -a android.settings.APPLICATION_DETAILS_SETTINGS \
  -d package:com.android.chrome
# In MDM: set ChromeManagedConfiguration key
#   "DefaultWebUsbGuardSetting": 2
#   "URLBlocklist": ["*"] on unmanaged NFC-enabled sites