CVE-2026-17943: Google Chrome CSP Bypass Vulnerability

CVE-2026-17943 Overview

CVE-2026-17943 is a Content Security Policy (CSP) bypass vulnerability in the Parser component of Google Chrome. The flaw affects versions prior to 151.0.7922.72 on desktop platforms. A remote attacker can bypass CSP enforcement by serving a crafted HTML page to a targeted user. Chromium rates the security severity of this issue as Low. Exploitation requires user interaction, specifically visiting an attacker-controlled or compromised page. Successful exploitation weakens a defense-in-depth control that is designed to restrict script execution and resource loading in the browser context.

Critical Impact
A remote attacker can bypass Content Security Policy protections in Chrome, undermining a key browser mitigation against cross-site scripting and data injection attacks.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Parser component
Any application embedding a pre-patch Chromium engine

Discovery Timeline

2026-07-30 - CVE-2026-17943 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17943

Vulnerability Analysis

The vulnerability resides in Chrome's Parser implementation. The parser processes HTML documents before enforcing browser security policies such as CSP. An inappropriate implementation allows crafted HTML input to reach execution paths without correct policy checks. This category of flaw falls under Business Logic Error and Improper Access Control in the Parser flow. The result is that CSP directives configured by a site are not fully honored during rendering. Refer to the Google Chrome Update Blog Post and the Chromium Issue Tracker Entry for vendor detail.

Root Cause

The root cause is inappropriate handling of specific HTML constructs in the Parser. The parser fails to apply the site's CSP consistently when interpreting the crafted markup. This creates a gap between the policy the site author defines and the policy the browser enforces at rendering time.

Attack Vector

Exploitation is remote and requires the victim to load a crafted HTML page in a vulnerable Chrome build. An attacker hosts the page directly or injects the payload into a site that lacks separate input sanitization. Once loaded, the crafted markup causes the Parser to bypass CSP restrictions. This can enable script or resource loading that the site's CSP was intended to block. No verified proof-of-concept code is published for this issue; the vulnerability is described in prose only in the vendor advisory.

Detection Methods for CVE-2026-17943

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on managed endpoints
Outbound requests to unexpected script or resource origins from pages that publish restrictive CSP headers
Client-side CSP violation reports that stop arriving from sites where they were previously generated
HTML responses containing unusual parser-confusing constructs served from untrusted origins

Detection Strategies

Inventory installed Chrome and Chromium-derived browser versions across the fleet and flag builds below 151.0.7922.72
Monitor CSP report-uri and report-to endpoints for anomalous drops or spikes in violation reports
Inspect web proxy logs for HTML responses that trigger script execution against origins disallowed by the target site's CSP

Monitoring Recommendations

Enable browser version telemetry in endpoint management to identify unpatched Chrome installations
Correlate browser process events with subsequent network activity to identify unexpected script sources
Track visits to newly registered or low-reputation domains that serve HTML with suspicious inline content

How to Mitigate CVE-2026-17943

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force browser restart after update to ensure the patched binary is loaded into memory
Audit Chromium-based applications and Electron builds for embedded engine versions that predate the fix

Patch Information

Google released the fix in the Chrome Stable channel at version 151.0.7922.72. Details are published in the Google Chrome Update Blog Post. The corresponding Chromium tracking entry is available in the Chromium Issue Tracker Entry. Enterprises using managed update channels should confirm the patched build has rolled out to all user groups.

Workarounds

No vendor-supplied workaround is documented; apply the Chrome update as the primary remediation
Restrict browsing to trusted sites through web filtering until endpoints are patched
Enforce network-layer controls that block known malicious or newly registered domains serving untrusted HTML

bash

# Verify Chrome version on Windows, macOS, and Linux endpoints
# Windows (PowerShell)
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version

# Expected output: 151.0.7922.72 or later