CVE-2026-17912: Chrome for iOS Auth Bypass Vulnerability

CVE-2026-17912 Overview

CVE-2026-17912 is a navigation restriction bypass vulnerability affecting Google Chrome for iOS versions prior to 151.0.7922.72. The flaw stems from an inappropriate implementation in the Chrome for iOS component, allowing a remote attacker to circumvent navigation restrictions through a crafted HTML page. Chromium security engineers assigned this issue a Low severity rating.

An attacker exploiting this vulnerability convinces a target to visit a malicious webpage. The crafted content then bypasses browser navigation controls that would normally restrict cross-origin or policy-controlled navigation. Google has addressed the issue in the Chrome for iOS Stable channel.

Critical Impact
Remote attackers can bypass navigation restrictions in Chrome for iOS through crafted HTML pages, potentially enabling phishing, UI spoofing, or unauthorized redirection.

Affected Products

Google Chrome for iOS prior to 151.0.7922.72
iOS devices running vulnerable Chrome versions
Third-party iOS applications embedding vulnerable Chrome components

Discovery Timeline

2026-07-30 - CVE-2026-17912 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17912

Vulnerability Analysis

CVE-2026-17912 is classified as an inappropriate implementation defect in the Chrome for iOS navigation subsystem. Navigation restrictions exist to enforce security boundaries between origins, prevent unauthorized redirects, and constrain how frames and top-level browsing contexts interact. The flawed implementation fails to enforce one or more of these restrictions when processing a specifically crafted HTML page.

The vulnerability falls under the broader category of a business logic and access control flaw rather than a memory safety defect. Attackers can weaponize the bypass to facilitate phishing campaigns, redirect users to attacker-controlled pages after apparent trust cues, or defeat protections that assume navigation policy enforcement. Because the issue affects iOS specifically, it involves the WKWebView-based rendering path that Chrome uses on Apple platforms rather than the Blink engine used on desktop.

Root Cause

The root cause resides in Chrome for iOS logic that validates or filters navigation events. The implementation does not correctly evaluate navigation policy under conditions triggered by attacker-controlled HTML. Full technical specifics are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires user interaction. The victim must load or be redirected to a page hosting the crafted HTML payload. No authentication or elevated privileges are needed on the client side, and the attack proceeds over standard web traffic. The vulnerability manifests in the navigation handling path invoked when the crafted HTML content is parsed and rendered.

For further technical detail, refer to the Google Chrome Stable Update release notes.

Detection Methods for CVE-2026-17912

Indicators of Compromise

Chrome for iOS clients reporting versions earlier than 151.0.7922.72 in mobile device management (MDM) telemetry
Unexpected navigation sequences in web proxy logs originating from iOS Chrome user-agents
Users landing on credential-harvesting or spoofed pages after clicking links inside Chrome for iOS

Detection Strategies

Inventory Chrome for iOS versions across managed mobile devices using MDM or unified endpoint management reporting
Correlate web gateway logs with Chrome iOS user-agent strings to identify anomalous cross-origin redirection chains
Monitor phishing telemetry for campaigns specifically targeting iOS Chrome users with crafted HTML lures

Monitoring Recommendations

Alert on iOS Chrome installations that remain below build 151.0.7922.72 beyond a defined patch window
Track outbound HTTPS requests from mobile devices to newly registered or low-reputation domains
Review URL filtering categories for browser-based social engineering and enable enhanced phishing protection

How to Mitigate CVE-2026-17912

Immediate Actions Required

Update Google Chrome for iOS to version 151.0.7922.72 or later through the Apple App Store
Enforce automatic app updates for managed iOS devices via MDM configuration profiles
Communicate the update requirement to end users and confirm compliance through device posture checks

Patch Information

Google has released a fixed build of Chrome for iOS. Users and administrators should install 151.0.7922.72 or later. The advisory and release details are available in the Google Chrome Stable Update announcement, with the underlying issue documented in the Chromium Issue Tracker Entry.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is deployed
Route mobile web traffic through a secure web gateway that enforces URL filtering and phishing protection
Educate users to avoid opening unsolicited links inside Chrome for iOS until patched builds are confirmed installed

bash

# Verify installed Chrome for iOS build via MDM query (example concept)
# Query app inventory for bundle identifier com.google.chrome.ios
# Confirm reported version >= 151.0.7922.72
mdm-cli devices query --app-bundle com.google.chrome.ios --min-version 151.0.7922.72