CVE-2026-17954 Overview
CVE-2026-17954 is a policy bypass vulnerability in the MHTML (MIME HTML) handling component of Google Chrome. The flaw affects versions prior to 151.0.7922.72 and permits a remote attacker to leak cross-origin data through a crafted MHTML page. Chromium engineers rated the security severity as Low. Exploitation requires a target user to load attacker-controlled MHTML content, at which point same-origin policy protections can be circumvented to disclose data from other origins.
Critical Impact
A remote attacker can leak cross-origin data by delivering a crafted MHTML page to a user running a Chrome build earlier than 151.0.7922.72.
Affected Products
- Google Chrome Desktop versions prior to 151.0.7922.72
- Chromium-based browsers incorporating the vulnerable MHTML handler
- MHTML (MIME Encapsulation of Aggregate HTML) processing component
Discovery Timeline
- 2026-07-30 - CVE-2026-17954 published to NVD
- 2026-07-30 - Last updated in NVD database
- Vendor fix delivered in the Chrome Stable Channel update referenced in the Google Chrome Stable Update
Technical Details for CVE-2026-17954
Vulnerability Analysis
The defect resides in how Chrome enforces security policy when parsing and rendering MHTML archives. MHTML bundles a web page and its resources into a single MIME-formatted file. Chrome must apply origin-based restrictions when loading these archives so that resources cannot read data belonging to unrelated origins. The bypass permits crafted MHTML content to sidestep those restrictions and observe cross-origin data. The issue is tracked in the Chromium Issue Tracker Entry.
Root Cause
The root cause is improper enforcement of cross-origin policy inside the MHTML loader. The parser processes parts of the archive under conditions that do not correctly isolate content boundaries. This is an information disclosure weakness rooted in inconsistent origin handling rather than memory corruption.
Attack Vector
An attacker hosts or delivers a crafted .mhtml file to the victim. When the user opens the file in an unpatched Chrome build, the browser processes attacker-controlled MHTML parts. The malicious archive triggers the policy bypass and reads cross-origin resources reachable from the browsing context. Delivery paths include phishing attachments, drive-by downloads, and links from compromised sites.
No verified proof-of-concept code is publicly available for CVE-2026-17954. Technical details are limited to the vendor advisory and the Chromium issue tracker.
Detection Methods for CVE-2026-17954
Indicators of Compromise
- Unexpected .mhtml or multipart/related files delivered via email or web downloads to end-user endpoints
- Chrome browser instances still reporting versions below 151.0.7922.72 after the patch release window
- Outbound requests from browser processes to unfamiliar domains shortly after opening MHTML archives
Detection Strategies
- Inventory installed Chrome versions across managed endpoints and flag any build older than 151.0.7922.72
- Inspect web proxy and email gateway logs for MHTML file transfers from untrusted sources
- Monitor Chrome child process activity for anomalous cross-origin fetches following MHTML file opens
Monitoring Recommendations
- Enable browser telemetry forwarding to a central log store to track version compliance and file-open events
- Alert on MIME types message/rfc822 and multipart/related served with .mhtml or .mht extensions from external sources
- Correlate MHTML open events with subsequent DNS lookups or HTTP requests to previously unseen destinations
How to Mitigate CVE-2026-17954
Immediate Actions Required
- Update Google Chrome to version 151.0.7922.72 or later on all desktop platforms
- Restart Chrome after applying the update so the new binary is loaded on every endpoint
- Push the patched build through enterprise management channels to guarantee coverage on managed fleets
Patch Information
Google addressed the issue in the Chrome Stable Channel release announced in the Google Chrome Stable Update. Chromium downstream vendors should integrate the corresponding upstream fix referenced in the Chromium Issue Tracker Entry and ship updated builds to users.
Workarounds
- Block delivery of .mhtml and .mht attachments at the email gateway until endpoints are patched
- Disable MHTML handling through enterprise browser policy where the workflow does not require it
- Restrict opening of MHTML archives from untrusted sources through user awareness guidance
# Verify installed Chrome version on Linux endpoints
google-chrome --version
# Example Windows registry policy to block file downloads by extension
# HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist
reg query "HKLM\SOFTWARE\Policies\Google\Chrome" /v DownloadRestrictions
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
