CVE-2026-17923: Google Chrome Policy Bypass Vulnerability

CVE-2026-17923 Overview

CVE-2026-17923 is a policy bypass vulnerability in the Enterprise component of Google Chrome. The flaw affects Chrome versions prior to 151.0.7922.72. A remote attacker can bypass enterprise navigation restrictions by supplying a crafted domain name. Chromium classifies the security severity as Low.

The issue undermines administrator-defined URL blocklists and navigation policies that enterprises rely on to restrict user browsing. Successful exploitation lets remote content evade policy enforcement without requiring elevated privileges on the endpoint.

Critical Impact
Attackers can bypass Chrome Enterprise navigation restrictions through crafted domain names, allowing users to reach resources that administrators intended to block.

Affected Products

Google Chrome (Desktop) versions prior to 151.0.7922.72
Chrome Enterprise deployments relying on navigation restriction policies
Chromium-based builds that inherit the affected navigation policy logic

Discovery Timeline

2026-07-30 - CVE-2026-17923 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17923

Vulnerability Analysis

The vulnerability resides in the Enterprise policy enforcement path that governs navigation controls in Chrome. Enterprise administrators use policies such as URLBlocklist and URLAllowlist to restrict which domains users can access. The affected code fails to normalize or validate certain crafted domain name inputs consistently, allowing navigation to proceed when it should be blocked.

Because the flaw sits in policy evaluation rather than the rendering engine, exploitation does not require memory corruption or code execution. The attacker only needs to control or host a domain whose name is crafted to defeat policy comparison logic. See the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for release context.

Root Cause

The root cause is inconsistent handling of domain name representations during policy matching. When Chrome compares a navigation target against enterprise policy entries, the crafted domain does not match the intended blocked pattern, yet resolves normally for navigation. This mismatch is a form of improper input validation in policy enforcement.

Attack Vector

The attack vector is remote. An attacker registers or controls a domain whose name form evades administrator-configured navigation restrictions. The victim, or an attacker-controlled resource such as a link, iframe, or redirect, triggers navigation to the crafted domain. Chrome permits the navigation despite an existing enterprise policy that should have blocked it.

No synthetic exploit code is published for this issue. Refer to the vendor references for authoritative technical details.

Detection Methods for CVE-2026-17923

Indicators of Compromise

Browser navigation events to domains that resemble but do not exactly match blocked entries in URLBlocklist
Access log entries from proxies or secure web gateways showing traffic to unusual domain forms from Chrome clients on versions earlier than 151.0.7922.72
User reports of reaching internal or external sites that enterprise policy is expected to block

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any client below 151.0.7922.72
Correlate browser telemetry with proxy or DNS logs to identify navigation events that bypass policy but originate from policy-managed Chrome installs
Compare enterprise policy blocklist entries against observed navigation targets to surface near-match domain names

Monitoring Recommendations

Forward Chrome version and policy status telemetry to a central log store for continuous version compliance checks
Enable proxy-side URL filtering as a compensating control and alert on discrepancies between proxy decisions and browser policy state
Track outbound DNS resolutions from browser processes for domains that closely mimic restricted destinations

How to Mitigate CVE-2026-17923

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Verify that automatic update channels are functional and that Chrome relaunches complete after patch deployment
Enforce URL filtering at the network perimeter as a layered control that does not depend solely on browser policy

Patch Information

Google addressed the issue in the Chrome Stable channel at version 151.0.7922.72. Deployment details and the release announcement are documented in the Google Chrome Desktop Update. Additional technical background is available in the Chromium Issue Tracker Entry.

Workarounds

Apply blocklist entries using broader patterns and wildcards to reduce the surface exposed by crafted domain variants
Route all HTTP and HTTPS traffic through an enterprise proxy or secure web gateway that enforces domain restrictions independently of the browser
Restrict egress DNS resolution to enterprise resolvers that enforce category and domain filtering

bash

# Verify Chrome version on managed endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv