CVE-2026-17925: Chrome for Android Auth Bypass Vulnerability

CVE-2026-17925 Overview

CVE-2026-17925 affects the Cast component in Google Chrome on Android prior to version 151.0.7922.72. An inappropriate implementation in Cast allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Google classified the Chromium security severity as Low. The same-origin policy is a foundational browser security control that prevents scripts from one origin from accessing data on another origin. A bypass enables cross-origin data access that should be blocked by the browser.

Critical Impact
A remote attacker can bypass same-origin policy protections in Chrome for Android via a crafted HTML page, potentially exposing cross-origin data to malicious sites.

Affected Products

Google Chrome on Android prior to 151.0.7922.72
Chromium Cast component (mobile builds)
Downstream Chromium-based Android browsers using the affected Cast implementation

Discovery Timeline

2026-07-30 - CVE-2026-17925 published to NVD
2026-07-30 - Last updated in NVD database
Reference - Google Chrome Update Announcement
Reference - Chromium Issue Tracker Entry

Technical Details for CVE-2026-17925

Vulnerability Analysis

The vulnerability resides in the Cast feature of Google Chrome on Android. Cast enables the browser to discover and stream content to remote receivers such as Chromecast devices. The implementation did not correctly enforce origin boundaries when handling content interactions initiated through a crafted HTML page. An attacker-controlled page could leverage this weakness to reach data or functionality bound to a different origin. This class of flaw falls under Authorization Bypass and specifically breaks the same-origin policy [CWE-346 style origin validation error].

Root Cause

The root cause is an inappropriate implementation in the Cast component that fails to correctly validate or isolate origin context during specific Cast-related operations. When an untrusted document interacts with the Cast pathway, security checks that should segregate origin state are not applied consistently. The result is a same-origin policy bypass reachable from ordinary web content.

Attack Vector

Exploitation requires the target user to visit a malicious or attacker-controlled web page in Chrome for Android prior to 151.0.7922.72. The crafted HTML page triggers the flawed Cast code path to obtain access across origin boundaries. No authentication is required, and interaction is limited to visiting the page. See the Chromium Issue Tracker Entry for additional technical context.

No verified proof-of-concept code is publicly available. Refer to the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2026-17925

Indicators of Compromise

Chrome for Android clients reporting a version string below 151.0.7922.72 in HTTP User-Agent headers observed in proxy or web logs.
Unexpected outbound requests from mobile browsers to Cast discovery endpoints correlated with visits to untrusted domains.
Cross-origin resource access patterns in web application logs that do not match legitimate application flows.

Detection Strategies

Inventory mobile Chrome versions across managed Android devices using MDM or UEM reporting and flag builds below 151.0.7922.72.
Correlate browsing telemetry with visits to newly registered or low-reputation domains that serve HTML invoking Cast APIs.
Review web server access logs for anomalous cross-origin request sequences originating from mobile Chrome clients.

Monitoring Recommendations

Track Chrome for Android release adoption rates and alert on devices that remain on vulnerable versions after the patch window.
Monitor egress DNS and HTTP traffic for suspicious domains delivering HTML that references Cast or media routing APIs.
Enable browser telemetry forwarding to a central log platform to retain evidence of exploitation attempts.

How to Mitigate CVE-2026-17925

Immediate Actions Required

Update Google Chrome on Android to version 151.0.7922.72 or later through Google Play.
Enforce a minimum Chrome version policy in mobile device management to block or warn on outdated installs.
Communicate the update requirement to end users and validate compliance through device inventory reports.

Patch Information

Google addressed the issue in Chrome 151.0.7922.72 for Android. Details are available in the Google Chrome Update Announcement. Downstream Chromium-based Android browsers should incorporate the corresponding Chromium fix referenced in the Chromium Issue Tracker Entry.

Workarounds

Restrict user access to untrusted websites through DNS filtering or secure web gateway policies until devices are patched.
Advise users to avoid clicking links from unsolicited messages while running an unpatched Chrome build on Android.
Where feasible, use an alternate updated browser on Android until the Chrome update is applied.

bash

# Verify installed Chrome version on a managed Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should be versionName=151.0.7922.72 or higher