CVE-2026-17917: Chrome for iOS Auth Bypass Vulnerability

CVE-2026-17917 Overview

CVE-2026-17917 is an insufficient policy enforcement vulnerability in Google Chrome for iOS prior to version 151.0.7922.72. The flaw allows a remote attacker to bypass discretionary access control by serving a crafted HTML page to a targeted user. Google's Chromium security team rates the severity as Low. The issue affects the iOS-specific build of Chrome and was addressed in the stable channel update referenced in the Google Chrome release blog.

Critical Impact
A remote attacker can bypass discretionary access control in Chrome for iOS by luring a user to a crafted HTML page, potentially undermining browser security policies.

Affected Products

Google Chrome for iOS versions prior to 151.0.7922.72
iOS devices running vulnerable Chrome builds
Users accessing untrusted web content via affected Chrome for iOS versions

Discovery Timeline

2026-07-30 - CVE-2026-17917 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17917

Vulnerability Analysis

The vulnerability stems from insufficient policy enforcement within Chrome for iOS. Policy enforcement layers in a browser mediate what content and scripts can do, including cross-origin access, download handling, and access to platform resources. When enforcement is incomplete, an attacker-controlled page can operate outside the intended security boundary.

In this case, a crafted HTML page can bypass discretionary access control (DAC). DAC governs which resources or actions a subject is permitted to access based on identity and defined policy. The bypass occurs when the browser fails to consistently apply that policy for specific content or navigation flows on iOS.

Chromium's security team assigned this issue a Low severity, indicating limited direct impact but a valid deviation from expected browser policy behavior. Refer to the Chromium Issue Tracker Entry for technical detail as it becomes public.

Root Cause

The root cause is missing or incomplete enforcement of an access control policy in the iOS build of Chrome. Because Chrome on iOS is built on WebKit rather than Blink, iOS-specific glue code and integrations with UIKit APIs are common sources of enforcement gaps that do not appear in desktop Chrome.

Attack Vector

Exploitation requires a user to load a crafted HTML page in a vulnerable Chrome for iOS build. The attacker hosts the malicious page or injects it into a site the victim visits. No authentication is required, and the attacker does not need local access to the device.

No verified exploit code is available. Refer to the Chromium issue tracker entry
for technical details once the bug report is unrestricted.

Detection Methods for CVE-2026-17917

Indicators of Compromise

Chrome for iOS clients reporting versions earlier than 151.0.7922.72 in mobile device management (MDM) inventory
Unexpected navigations from user-clicked links to unfamiliar HTML pages hosting scripted redirects or policy-testing payloads
User reports of unusual browser behavior after visiting untrusted links

Detection Strategies

Query MDM and endpoint inventory for Chrome for iOS versions below 151.0.7922.72 and flag noncompliant devices.
Inspect web proxy and DNS logs for traffic to newly registered or low-reputation domains delivering HTML content to iOS user agents.
Correlate mobile browser telemetry with URL reputation feeds to identify sessions hitting known malicious hosts.

Monitoring Recommendations

Track Chrome for iOS version distribution across the fleet and alert on stalled updates.
Monitor mobile web traffic for phishing patterns that target Chrome for iOS users.
Review the Google Chrome Update Blog Post and Chromium tracker for follow-on advisories.

How to Mitigate CVE-2026-17917

Immediate Actions Required

Update Chrome for iOS to version 151.0.7922.72 or later on all managed devices through the App Store or MDM-managed app updates.
Communicate the update requirement to end users and enforce compliance through conditional access policies where available.
Block or warn on access to untrusted links from mobile clients until fleetwide patching is confirmed.

Patch Information

Google addressed the vulnerability in Chrome for iOS 151.0.7922.72. See the Google Chrome Update Blog Post for the official release notes, and the Chromium Issue Tracker Entry for the underlying bug record.

Workarounds

Restrict use of Chrome for iOS on managed devices until the patched version is installed.
Direct users to an alternate managed browser with equivalent enterprise controls during remediation.
Enforce URL filtering at the network layer to reduce exposure to crafted HTML pages hosted on untrusted domains.

bash

# Example: verify Chrome for iOS version compliance via MDM inventory query
# Pseudocode - replace with your MDM's actual query syntax
mdm-cli query apps \
  --bundle-id com.google.chrome.ios \
  --min-version 151.0.7922.72 \
  --report noncompliant