CVE-2026-17911: Google Chrome SVG Information Disclosure

CVE-2026-17911 Overview

CVE-2026-17911 is an insufficient policy enforcement vulnerability in the Scalable Vector Graphics (SVG) implementation in Google Chrome. Versions prior to 151.0.7922.72 fail to properly enforce security policies when handling SVG content. A remote attacker can exploit this weakness by delivering a crafted HTML page that causes the browser to leak cross-origin data. Google rates the Chromium security severity as Low. The flaw undermines the same-origin policy, one of the browser's foundational security boundaries.

Critical Impact
Attackers can leak sensitive cross-origin data from other web applications by luring users to a malicious HTML page rendered in an unpatched Chrome browser.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable SVG rendering code
Embedded applications using the affected Chromium versions

Discovery Timeline

2026-07-30 - CVE-2026-17911 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17911

Vulnerability Analysis

The vulnerability resides in Chrome's SVG handling logic, where policy enforcement checks are insufficient for cross-origin content. SVG documents can reference external resources and embed content from other origins through elements such as <image>, <use>, and filter primitives. When Chrome processes these references, the affected code path does not consistently apply the checks required to prevent cross-origin data disclosure. An attacker who controls a page loaded by the victim can construct SVG markup that observes or infers data belonging to a different origin. This defeats the same-origin policy for content the user's browser has authorization to access, such as authenticated resources on other sites.

Root Cause

The root cause is missing or incomplete policy enforcement in the SVG subsystem of Blink, Chrome's rendering engine. Security-sensitive operations on SVG elements do not verify origin boundaries before exposing computed or referenced data to the calling document. Google's public advisory does not disclose the specific SVG feature or code path involved.

Attack Vector

Exploitation requires the victim to visit a crafted HTML page under attacker control or one that has been compromised. No user interaction beyond page navigation is required. The malicious page embeds SVG content that references cross-origin resources and then reads back rendered or computed values to reconstruct the target data. Successful exploitation returns cross-origin information to the attacker without any indication to the user. See the Chromium Issue Tracker Entry and the Google Blog Chrome Update for available technical context.

Detection Methods for CVE-2026-17911

Indicators of Compromise

Web traffic to unfamiliar domains serving HTML pages with heavy inline SVG markup referencing cross-origin URLs
Browser telemetry showing outbound requests to third-party origins triggered from <svg>, <image>, <use>, or <foreignObject> elements
Chrome installations reporting versions earlier than 151.0.7922.72 in endpoint inventory scans

Detection Strategies

Inventory browser versions across managed endpoints and flag Chrome installations below 151.0.7922.72
Inspect proxy and DNS logs for user visits to newly registered domains hosting SVG-heavy content shortly before anomalous authenticated requests
Correlate browser process activity with unexpected cross-origin fetches originating from SVG rendering

Monitoring Recommendations

Enable browser update reporting in enterprise management consoles to confirm patch propagation
Route web traffic through a secure web gateway and log full URLs for HTML and SVG content
Alert on outbound requests to low-reputation domains from user sessions handling sensitive web applications

How to Mitigate CVE-2026-17911

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart browsers after deployment to ensure the patched binary is loaded
Verify that Chromium-based browsers in the environment have absorbed the upstream fix

Patch Information

Google addressed the issue in the Stable Channel update to Chrome 151.0.7922.72. Administrators should reference the Google Blog Chrome Update for the full release notes and the Chromium Issue Tracker Entry for issue metadata. Chromium-based browsers such as Microsoft Edge, Brave, and Opera should be updated once their vendors integrate the upstream patch.

Workarounds

Enforce automatic Chrome updates through group policy or mobile device management to shorten the patch window
Restrict browsing to trusted sites on hosts that cannot be immediately patched
Deploy content filtering to block SVG payloads from untrusted origins where feasible

bash

# Verify installed Chrome version on Windows
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" /v Version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version