CVE-2026-17936: Chrome DevTools Auth Bypass Vulnerability

CVE-2026-17936 Overview

CVE-2026-17936 is an inappropriate implementation vulnerability in the DevTools component of Google Chrome prior to version 151.0.7922.72. A remote attacker who convinces a user to perform specific UI gestures can bypass navigation restrictions through a crafted HTML page. Google classifies the Chromium security severity as Low. The issue combines a browser-side implementation weakness with a social engineering requirement, since exploitation depends on user interaction with attacker-controlled content. Google addressed the flaw in the Chrome Stable channel update for desktop platforms.

Critical Impact
A remote attacker can bypass Chrome navigation restrictions via crafted HTML pages when a user performs specific UI gestures, potentially enabling redirection to attacker-controlled destinations.

Affected Products

Google Chrome for Desktop prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable DevTools code
All desktop platforms served by the Chrome Stable channel update

Discovery Timeline

2026-07-30 - CVE-2026-17936 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17936

Vulnerability Analysis

The vulnerability resides in Chrome DevTools, the built-in developer tooling that ships with the browser. An inappropriate implementation allows a crafted HTML page to bypass navigation restrictions when the user performs specific interface gestures. Navigation restrictions in Chrome exist to prevent pages from directing users to origins they would not otherwise reach through automated flows. Bypassing these restrictions removes a control that would ordinarily block attacker-influenced redirection.

Exploitation is not fully automatic. The attacker must present crafted markup and convince the target to interact with the page in a specific way. Successful abuse could support phishing chains, redirection to malicious download flows, or delivery of follow-on browser exploits. Google rated the Chromium severity as Low, reflecting the required user interaction and the constrained impact of the primitive.

Root Cause

The root cause is an implementation defect in how DevTools handles navigation checks in the presence of certain user interface gestures. The component does not consistently enforce the same navigation restrictions applied elsewhere in the browser, producing an inconsistency that a crafted page can leverage. Full technical details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Delivery is remote and web-based. The attacker hosts a crafted HTML page and lures a target to visit it, then relies on the user performing a specific gesture such as a click sequence or drag interaction. Once the gesture triggers the flawed DevTools code path, the page can navigate the browser in a way that would normally be blocked. No authentication or elevated privileges are required on the target system.

No public proof-of-concept code is available. Refer to the Google Chrome Desktop Update advisory for vendor guidance.

Detection Methods for CVE-2026-17936

Indicators of Compromise

Chrome browser instances running versions earlier than 151.0.7922.72 in enterprise inventory
Browser history entries showing unexpected navigations following visits to untrusted HTML content
Proxy or DNS logs recording redirection chains that terminate at credential-harvesting or malware distribution domains

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Correlate web proxy telemetry with endpoint browser process activity to identify anomalous cross-origin navigations
Review DevTools usage patterns on high-value user accounts, since DevTools activity outside developer populations warrants scrutiny

Monitoring Recommendations

Ingest browser version telemetry into your SIEM or data lake and alert on outdated Chrome builds
Monitor for phishing lures and social engineering campaigns that reference browser interaction prompts
Track downloads and process launches that follow browser navigation events to detect exploitation chains

How to Mitigate CVE-2026-17936

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop endpoints
Restart Chrome processes after the update so the patched binaries take effect
Validate that Chromium-derived browsers in the environment have absorbed the upstream fix

Patch Information

Google released the fix in the Chrome Stable channel update for desktop. Administrators should deploy 151.0.7922.72 or a later Stable release. Details are published in the Google Chrome Desktop Update announcement, with the underlying bug tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce automatic Chrome updates through enterprise policy to close the exposure window
Restrict browsing to trusted sites for high-risk user groups until patch deployment completes
Reinforce user awareness training on suspicious pages that request specific clicks, drags, or keyboard gestures

bash

# Verify installed Chrome version on managed endpoints
google-chrome --version

# Windows: query the installed version from the registry
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv