CVE-2026-17927: Chrome DevTools Information Disclosure

CVE-2026-17927 Overview

CVE-2026-17927 is an insufficient policy enforcement vulnerability in the DevTools component of Google Chrome prior to version 151.0.7922.72. The flaw allows an attacker who convinces a user to install a malicious extension to leak cross-origin data via a crafted Chrome extension. Chromium rates the security severity as Low. Exploitation requires user interaction, specifically the installation of an attacker-controlled extension from an untrusted source.

Critical Impact
A malicious Chrome extension can bypass DevTools policy checks to read cross-origin data, breaking the Same-Origin Policy boundary that isolates web content across sites.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected DevTools code
Chrome extensions runtime prior to the patched Stable Channel release

Discovery Timeline

2026-07-30 - CVE-2026-17927 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17927

Vulnerability Analysis

The vulnerability resides in the DevTools subsystem of Google Chrome. DevTools exposes privileged APIs to extensions that declare the devtools_page manifest key. These APIs are governed by policy checks that restrict extensions from reading data across origin boundaries. The flaw stems from insufficient enforcement of those policy checks, allowing a crafted extension to access resources it should not be permitted to read.

The result is a cross-origin information disclosure. An attacker who successfully persuades a victim to install a malicious extension can harvest data from origins unrelated to the extension's declared host permissions. This includes content rendered in inspected tabs and potentially cached responses accessible through the DevTools protocol.

Root Cause

The root cause is a missing or incomplete authorization check inside a DevTools policy boundary. The DevTools APIs that surface network, storage, or DOM data to extensions did not consistently validate the origin context before returning results. As a consequence, an extension holding only DevTools-related permissions can request data belonging to other origins.

Attack Vector

Exploitation requires the attacker to distribute a malicious Chrome extension and convince the victim to install it. Once installed, the extension loads its devtools_page and invokes the vulnerable API surface to retrieve cross-origin resources. No memory corruption is involved. The attack is entirely logic-based and executes within the extension sandbox.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor-published technical context.

Detection Methods for CVE-2026-17927

Indicators of Compromise

Chrome extensions declaring a devtools_page in manifest.json sourced from outside the official Chrome Web Store or from unverified publishers.
Unexpected extension installations recorded in enterprise Chrome management logs or the chrome://extensions inventory.
Outbound network traffic from Chrome to attacker-controlled domains correlating with active DevTools sessions.

Detection Strategies

Inventory installed Chrome extensions across managed endpoints and flag any manifest containing the devtools_page key from unknown publishers.
Correlate browser version telemetry against 151.0.7922.72 to identify unpatched hosts still exposed to the vulnerability.
Review Chrome Enterprise reporting for extension install events and permission grants that include debugger or DevTools APIs.

Monitoring Recommendations

Enable Chrome Enterprise extension telemetry and forward events to a centralized log platform for retention and query.
Alert on new extension installations that request debugger, devtools, or broad host permissions.
Monitor endpoint DNS and proxy logs for connections initiated by Chrome renderer or extension processes to unrecognized destinations.

How to Mitigate CVE-2026-17927

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Audit installed extensions and remove any not sourced from the Chrome Web Store or an approved allowlist.
Restart Chrome after applying the update to ensure the patched DevTools code path is loaded.

Patch Information

Google addressed CVE-2026-17927 in Chrome Stable 151.0.7922.72. See the Google Chrome Stable Update advisory for release notes and rollout details. The fix landed in the DevTools policy enforcement code referenced in the Chromium Issue Tracker Entry.

Workarounds

Enforce an extension allowlist through Chrome Enterprise policy ExtensionInstallAllowlist and block all others with ExtensionInstallBlocklist set to *.
Restrict extension installations to the Chrome Web Store using the ExtensionInstallSources policy.
Educate users to reject extension install prompts originating outside official distribution channels until patching completes.

bash

# Chrome Enterprise policy example (Linux JSON policy file)
# /etc/opt/chrome/policies/managed/extension_policy.json
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "<approved-extension-id-1>",
    "<approved-extension-id-2>"
  ],
  "ExtensionInstallSources": [
    "https://chromewebstore.google.com/*"
  ]
}