CVE-2026-17928 Overview
CVE-2026-17928 is an information disclosure vulnerability in the DataTransfer implementation of Google Chrome versions prior to 151.0.7922.72. The flaw enables a remote attacker to leak cross-origin data through a crafted HTML page. Google classifies the Chromium security severity as Low. Exploitation requires the target user to visit or interact with attacker-controlled web content, making drive-by delivery through malicious sites or advertisements the primary attack path. The issue was addressed in the Stable channel desktop update for Chrome 151.0.7922.72.
Critical Impact
Successful exploitation allows a remote attacker to bypass the same-origin policy through DataTransfer and read data belonging to a different origin, undermining a core web security boundary.
Affected Products
- Google Chrome desktop versions prior to 151.0.7922.72
- Chromium-based browsers that inherit the vulnerable DataTransfer implementation
- Web applications relying on same-origin isolation when rendered in unpatched Chrome
Discovery Timeline
- 2026-07-30 - CVE-2026-17928 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17928
Vulnerability Analysis
The vulnerability resides in Chrome's DataTransfer interface, which handles data associated with drag-and-drop and clipboard operations in the browser. DataTransfer is expected to enforce origin boundaries so that data attached to a drag operation cannot be read by scripts running in an unrelated origin. The inappropriate implementation in versions prior to 151.0.7922.72 breaks that guarantee. A remote attacker delivering a crafted HTML page can observe or extract data that should remain scoped to another origin. Google's advisory characterizes the defect as an inappropriate implementation rather than a memory-safety issue, indicating a logic flaw in how the DataTransfer object mediates access between origins.
Root Cause
The root cause is a logic error in the enforcement of cross-origin restrictions within the DataTransfer object. The component fails to apply the expected same-origin checks against data exposed through its properties or events, allowing attacker-controlled script to reach data attached from a different origin during transfer operations.
Attack Vector
Exploitation is remote and web-based. The attacker hosts a crafted HTML page and lures the victim to load it, for example through phishing, malvertising, or a compromised site. When the victim interacts with the page, script on the attacker's origin uses DataTransfer to read cross-origin data that would normally be blocked. No authentication is required, and the victim's browser performs the disclosure automatically once the page executes.
No verified proof-of-concept code has been published for this issue. See the Chromium Issue Tracker Entry and Google Chrome Update Announcement for vendor detail as it becomes public.
Detection Methods for CVE-2026-17928
Indicators of Compromise
- Chrome browser processes reporting a version string below 151.0.7922.72 in endpoint inventory data.
- Outbound HTTP or HTTPS requests to unfamiliar domains immediately following user interaction with drag-and-drop or clipboard events on a web page.
- Web pages that programmatically invoke DataTransfer APIs together with iframe or cross-origin resource embedding.
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any instance below 151.0.7922.72.
- Inspect proxy and DNS logs for user navigation to newly registered or low-reputation domains that serve HTML with active scripting.
- Correlate browser telemetry with data-exfiltration patterns, such as small POST requests to third-party origins following user interaction events.
Monitoring Recommendations
- Track Chrome update compliance through endpoint management tooling and alert on out-of-date browsers.
- Monitor web gateway logs for repeated visits to uncategorized sites that host active content and cross-origin frames.
- Review browser extension and enterprise policy reports to confirm auto-update remains enabled on all endpoints.
How to Mitigate CVE-2026-17928
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all Windows, macOS, and Linux endpoints.
- Restart Chrome after the update so the patched binary is loaded into active browser sessions.
- Confirm that Chrome auto-update is enabled and not blocked by group policy or network filtering.
Patch Information
Google addressed CVE-2026-17928 in the Stable channel desktop release 151.0.7922.72. Full release details are available in the Google Chrome Update Announcement. The underlying Chromium bug is tracked in the Chromium Issue Tracker Entry.
Workarounds
- Restrict browsing to trusted sites through web filtering until the patched Chrome build is deployed.
- Educate users to avoid interacting with drag-and-drop prompts on unfamiliar web pages.
- Deploy enterprise browser policies that disable or restrict clipboard and drag-and-drop APIs where business need permits.
# Verify installed Chrome version on Linux or macOS
google-chrome --version
# Windows: check version via registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
